[{"data":1,"prerenderedAt":20550},["ShallowReactive",2],{"blog-\u002Fblog\u002Freading-memory-by-painting-it":3},{"id":4,"title":5,"body":6,"date":20539,"description":20540,"endMark":20541,"extension":20542,"illustration":20541,"meta":20543,"navigation":20544,"path":20545,"seo":20546,"stem":20547,"unlisted":20548,"__hash__":20549},"blog\u002Fblog\u002Freading-memory-by-painting-it.md","Reading memory by painting it",{"type":7,"value":8,"toc":20489},"minimark",[9,19,22,25,28,33,41,369,372,375,379,382,386,390,393,396,399,402,406,409,448,453,456,462,465,486,493,496,500,503,507,633,636,639,679,682,690,694,986,2128,2133,2136,2140,2143,2147,2150,2153,2158,2162,2165,2185,2188,2195,2198,2201,2206,2209,2213,2217,2220,2475,2478,2481,2485,3175,3686,3689,3695,3698,3701,3708,3712,3715,3729,3732,3736,3739,3759,3762,3766,3769,3772,3778,3782,3785,3788,3906,3909,3913,3916,3919,3925,3928,3932,3935,3955,3958,3962,3965,3985,3988,3992,3995,3999,4002,4006,4009,4012,4016,4019,4022,4026,4029,4043,4046,4052,4055,4058,4062,4065,4068,4076,4079,4082,4295,4298,4443,4447,4450,4652,4655,4658,5561,5564,5886,5959,6278,6281,6519,7247,7710,7784,7893,8198,8565,8568,8573,8576,8580,8583,8586,8589,8592,8600,8603,9411,10001,10083,10342,11259,11518,11742,11745,12311,12838,13724,14194,14299,15082,15345,15546,15636,15775,15836,15972,16003,16134,16137,16537,16543,16546,16550,16553,16557,16560,16586,16589,16593,16596,16599,16605,16612,16617,16621,16624,16627,16810,16816,16819,16823,16826,16829,16835,16838,16842,16845,16886,16889,16892,16898,16901,16906,16910,16913,16918,16921,16925,16932,17371,17940,17943,17946,19392,19395,19409,19412,20061,20064,20069,20074,20080,20085,20088,20092,20095,20198,20201,20206,20209,20215,20218,20222,20225,20245,20248,20259,20262,20266,20338,20342,20404,20408,20440,20444,20447,20454,20485],[10,11,12,18],"p",{},[13,14,17],"span",{"class":15,"style":16},"dropcap","--dc-w: 1.28em","T","he GPU process is a one-way pipe: draw commands in, pixels out, almost\nnothing else. So you do the only thing the pipe allows: have the GPU paint\nthe memory onto a canvas and read the painting back.",[10,20,21],{},"That is the core of a renderer-to-GPU sandbox escape I wrote up for Chrome\n146. A Skia integer overflow corrupts a neighboring path object, and the GPU\nreads chosen bytes as float coordinates and rasterizes them. The renderer\nreads the pixels back and reconstructs the original values.",[10,23,24],{},"Think of the value as an unknown coordinate, a pin on an infinite plane, and\nthe canvas as a fixed-size map the GPU draws the pin onto. Mostly the pin\nlands off the map, since a random byte read as a float is usually\nastronomically large or vanishingly small. The search is a pan-and-zoom.\nFirst find the zoom that brings the pin onto the map at all, which fixes the\nexponent, the scale where the value lives. Then zoom in and pan to keep the\npin centered, each step pinning down more digits of the coordinate. After a\nfew rounds the exact coordinate is recovered, a few bits at a time.",[26,27],"reading-memory-pan-zoom",{},[29,30,32],"h2",{"id":31},"why-the-pin-doesnt-drift","Why the pin doesn't drift",[10,34,35,36,40],{},"Pan-and-zoom runs on floating point, which normally loses bits, and a map\nthat drifts as you zoom is useless. Two choices keep it exact. Zooming by a\npower of two only shifts the exponent and never rounds the mantissa. Panning\nsubtracts two close, same-signed values, which ",[37,38,39],"strong",{},"Sterbenz's Lemma"," guarantees\nis computed with zero rounding error.",[42,43,44],"note",{"label":39},[10,45,46,47,92,93,124,125,312,313,368],{},"In a floating-point number system with subnormal numbers, if ",[13,48,51,73],{"className":49},[50],"katex",[13,52,55],{"className":53},[54],"katex-mathml",[56,57,59],"math",{"xmlns":58},"http:\u002F\u002Fwww.w3.org\u002F1998\u002FMath\u002FMathML",[60,61,62,69],"semantics",{},[63,64,65],"mrow",{},[66,67,68],"mi",{},"x",[70,71,68],"annotation",{"encoding":72},"application\u002Fx-tex",[13,74,78],{"className":75,"ariaHidden":77},[76],"katex-html","true",[13,79,82,87],{"className":80},[81],"base",[13,83],{"className":84,"style":86},[85],"strut","height:0.4306em;",[13,88,68],{"className":89},[90,91],"mord","mathnormal"," and ",[13,94,96,110],{"className":95},[50],[13,97,99],{"className":98},[54],[56,100,101],{"xmlns":58},[60,102,103,108],{},[63,104,105],{},[66,106,107],{},"y",[70,109,107],{"encoding":72},[13,111,113],{"className":112,"ariaHidden":77},[76],[13,114,116,120],{"className":115},[81],[13,117],{"className":118,"style":119},[85],"height:0.625em;vertical-align:-0.1944em;",[13,121,107],{"className":122,"style":123},[90,91],"margin-right:0.0359em;","\nare floating-point numbers with\n",[13,126,128,164],{"className":127},[50],[13,129,131],{"className":130},[54],[56,132,133],{"xmlns":58},[60,134,135,161],{},[63,136,137,146,150,152,154,156,158],{},[138,139,140,142],"mfrac",{},[66,141,107],{},[143,144,145],"mn",{},"2",[147,148,149],"mo",{},"≤",[66,151,68],{},[147,153,149],{},[143,155,145],{},[66,157,107],{},[147,159,160],{"separator":77},",",[70,162,163],{"encoding":72},"\\frac{y}{2} \\le x \\le 2y,",[13,165,167,276,295],{"className":166,"ariaHidden":77},[76],[13,168,170,174,264,269,273],{"className":169},[81],[13,171],{"className":172,"style":173},[85],"height:1.0925em;vertical-align:-0.345em;",[13,175,177,182,260],{"className":176},[90],[13,178],{"className":179},[180,181],"mopen","nulldelimiter",[13,183,185],{"className":184},[138],[13,186,190,251],{"className":187},[188,189],"vlist-t","vlist-t2",[13,191,194,246],{"className":192},[193],"vlist-r",[13,195,199,220,231],{"className":196,"style":198},[197],"vlist","height:0.7475em;",[13,200,202,207],{"style":201},"top:-2.655em;",[13,203],{"className":204,"style":206},[205],"pstrut","height:3em;",[13,208,214],{"className":209},[210,211,212,213],"sizing","reset-size6","size3","mtight",[13,215,217],{"className":216},[90,213],[13,218,145],{"className":219},[90,213],[13,221,223,226],{"style":222},"top:-3.23em;",[13,224],{"className":225,"style":206},[205],[13,227],{"className":228,"style":230},[229],"frac-line","border-bottom-width:0.04em;",[13,232,234,237],{"style":233},"top:-3.4461em;",[13,235],{"className":236,"style":206},[205],[13,238,240],{"className":239},[210,211,212,213],[13,241,243],{"className":242},[90,213],[13,244,107],{"className":245,"style":123},[90,91,213],[13,247,250],{"className":248},[249],"vlist-s","​",[13,252,254],{"className":253},[193],[13,255,258],{"className":256,"style":257},[197],"height:0.345em;",[13,259],{},[13,261],{"className":262},[263,181],"mclose",[13,265],{"className":266,"style":268},[267],"mspace","margin-right:0.2778em;",[13,270,149],{"className":271},[272],"mrel",[13,274],{"className":275,"style":268},[267],[13,277,279,283,286,289,292],{"className":278},[81],[13,280],{"className":281,"style":282},[85],"height:0.7719em;vertical-align:-0.136em;",[13,284,68],{"className":285},[90,91],[13,287],{"className":288,"style":268},[267],[13,290,149],{"className":291},[272],[13,293],{"className":294,"style":268},[267],[13,296,298,302,305,308],{"className":297},[81],[13,299],{"className":300,"style":301},[85],"height:0.8389em;vertical-align:-0.1944em;",[13,303,145],{"className":304},[90],[13,306,107],{"className":307,"style":123},[90,91],[13,309,160],{"className":310},[311],"mpunct","\nthen ",[13,314,316,335],{"className":315},[50],[13,317,319],{"className":318},[54],[56,320,321],{"xmlns":58},[60,322,323,332],{},[63,324,325,327,330],{},[66,326,68],{},[147,328,329],{},"−",[66,331,107],{},[70,333,334],{"encoding":72},"x - y",[13,336,338,359],{"className":337,"ariaHidden":77},[76],[13,339,341,345,348,352,356],{"className":340},[81],[13,342],{"className":343,"style":344},[85],"height:0.6667em;vertical-align:-0.0833em;",[13,346,68],{"className":347},[90,91],[13,349],{"className":350,"style":351},[267],"margin-right:0.2222em;",[13,353,329],{"className":354},[355],"mbin",[13,357],{"className":358,"style":351},[267],[13,360,362,365],{"className":361},[81],[13,363],{"className":364,"style":119},[85],[13,366,107],{"className":367,"style":123},[90,91]," is a floating-point number, so the subtraction is computed\nexactly.",[10,370,371],{},"So the coordinate you recover is the one actually in memory.",[10,373,374],{},"That sketch makes it sound like one trick. The engineering is rather more\ninvolved than that, and the rest of it lives in the full writeup.",[29,376,378],{"id":377},"what-makes-it-unusual","What makes it unusual",[10,380,381],{},"The odd part is the mix of fields. The attack is shaped like a problem in\nnumerical analysis and computational geometry, and its reliability is a\ntheorem, not a measurement. That is the difference between a read and a leak.",[383,384],"divider",{"text":385},"Full write-up",[29,387,389],{"id":388},"introduction","Introduction",[10,391,392],{},"This article's contribution is a visual memory-read primitive: reading GPU-process memory by drawing it. We use it to build a renderer-to-GPU-process sandbox escape for Chrome Stable M146 on Linux. A Skia integer overflow corrupts an adjacent path object so the GPU interprets chosen memory bytes as float coordinates and renders them as pixels; the renderer reads those pixels back and reconstructs the original pointer.",[10,394,395],{},"A pointer is an exact number; the canvas it gets drawn on is a grid only a few hundred pixels wide, so reading the pointer back off the pixels should lose most of it. It does not. The read recovers a pointer a few bits at a time, zooming the drawing so each successive slice fills the screen, and exploits exact properties of IEEE-754 floats and Skia's antialiasing so the recovered bits faithfully match memory.",[10,397,398],{},"The whole exploit bootstraps from two bugs: a Skia out-of-bounds write and a one-shot heap-address leak that defeats ASLR. We upgrade the OOB write to gain arbitrary write and read capabilities over the heap; the leak gives the one address everything else is computed from. From there the rest follows: groom PartitionAlloc, trigger the overflow, walk the heap to locate a function-pointer table, and hijack one of its entries. That final call reuses an indirect call site that the compiler leaves out of its Control Flow Integrity (CFI) checks, the defense that would otherwise reject a call through a corrupted function pointer.",[10,400,401],{},"All constants are from Chrome stable 146.0.7680.164 on Linux x64.",[29,403,405],{"id":404},"mitigation-surface","Mitigation surface",[10,407,408],{},"The GPU process enforces several standard memory-safety mitigations. To establish a reliable exploit pipeline, we must bypass or operate within the constraints of each defense:",[410,411,412,419,425,431,442],"ul",{},[413,414,415,418],"li",{},[37,416,417],{},"ASLR (Chrome binary)"," — randomizes the base address of executable code. Enabled: yes. Handling: bypassed by reading a code pointer from the heap once arbitrary memory reads are established, then calculating offsets to target functions.",[413,420,421,424],{},[37,422,423],{},"ASLR (PA pool)"," — randomizes PartitionAlloc heap regions. Enabled: yes. Handling: defeated by an initial heap address leak exposed in a GPU-to-renderer error message.",[413,426,427,430],{},[37,428,429],{},"PartitionAlloc bucket segregation"," — segregates allocations by size. Enabled: yes. Handling: bypassed by grooming target allocations into adjacent pages of the same size class.",[413,432,433,441],{},[37,434,435,436,440],{},"BackupRefPtr (",[437,438,439],"code",{},"raw_ptr\u003CT>",")"," — Chrome's UAF protection. Enabled: yes (for PartitionAlloc's BRP pool). Handling: avoided by targeting a heap object managed by a third-party smart pointer instead of Chrome's protected raw_ptr type.",[413,443,444,447],{},[37,445,446],{},"LLVM CFI (-fsanitize=cfi-icall)"," — forward-edge control flow integrity. Enabled: yes. Handling: bypassed by hijacking an indirect call site that is explicitly excluded from CFI compilation checks.",[449,450,452],"h3",{"id":451},"ipc-primer","IPC primer",[10,454,455],{},"The exploit drives the GPU process over IPC, specifically the raster command-buffer channel. The compromised renderer cannot directly instantiate C++ objects in the GPU process. Instead, it serializes command streams and maps Shared Memory (SHM) handles. The GPU process deserializes these streams into Skia commands using its hardware-accelerated rasterization backend (Ganesh).",[457,458],"diagram-columns",{":groups":459,"left":460,"right":461},"[{\"rows\":[{\"left\":\"IPC Command Buffer\",\"right\":\"RasterDecoderImpl\",\"dir\":\"right\"},{\"left\":\"BeginRaster \u002F EndRaster\",\"right\":\"open \u002F flush SkCanvas\",\"indent\":true},{\"left\":\"Raster(shm_id, off, sz)\",\"right\":\"deserialize PaintOps\",\"indent\":true},{\"left\":\"Create\u002FDelete TC\",\"right\":\"mutate transfer cache\",\"indent\":true},{\"left\":\"ReadbackARGB(out_shm)\",\"right\":\"copy pixels to SHM\",\"dir\":\"left\",\"indent\":true}]},{\"rows\":[{\"left\":\"SHM transfer buffers\",\"right\":\"paths, PaintOps, blobs\",\"dir\":\"right\"},{\"left\":\"SHM readback buffer\",\"right\":\"output pixels (ARGB)\",\"dir\":\"left\"}]}]","Renderer","GPU process (Ganesh)",[10,463,464],{},"Three command types matter for this chain:",[466,467,468,474,480],"ol",{},[413,469,470,473],{},[37,471,472],{},"Raster (geometry)",": Raster(shm_id, off, size) maps renderer SHM and calls PaintOp::Deserialize. This turns serialized byte streams into real Skia operations on the GPU thread.",[413,475,476,479],{},[37,477,478],{},"Transfer cache (heap grooming)",": CreateTransferCacheEntryINTERNAL maps renderer SHM into a GPU-side buffer, registering it under a unique ID. DeleteTransferCacheEntryINTERNAL drops the entry, reclaiming its backing allocation. Because command processing maintains strict FIFO order, this allows precise heap grooming.",[413,481,482,485],{},[37,483,484],{},"Readback (data exfiltration)",": ReadbackARGBImagePixelsINTERNAL copies rasterized pixels back into renderer-owned SHM. The renderer scans these pixels to reconstruct the leaked memory. Thus, our arbitrary read primitive must encode memory bytes into renderable color values.",[487,488,490],"callout",{"type":489},"tip",[10,491,492],{},"IPC command serialization allows the renderer to trigger arbitrary allocations (Transfer Cache) and read back rasterized canvas pixels in a strictly ordered execution sequence.",[10,494,495],{},"Our first obstacle in executing the exploit chain is defeating ASLR by finding out where we are in memory.",[29,497,499],{"id":498},"the-address-leak-defeating-heap-aslr","The address leak: defeating heap ASLR",[10,501,502],{},"The leak comes from a hex string the GPU returns over an IPC message.",[449,504,506],{"id":505},"the-logger-as-leak-primitive","The Logger-as-leak primitive",[508,509,514],"pre",{"className":510,"code":511,"language":512,"meta":513,"style":513},"language-cpp shiki shiki-themes github-light github-dark","\u002F\u002F gpu\u002Fcommand_buffer\u002Fservice\u002Flogger.cc (Logger::Logger; signature condensed)\nLogger::Logger(const DebugMarkerManager* debug_marker_manager, ...) {\n    Logger* this_temp = this;\n    this_in_hex_ = std::string(\"GroupMarkerNotSet(crbug.com\u002F242999)!:\")\n                   + base::HexEncode(&this_temp, sizeof(this_temp));\n}\n","cpp","",[437,515,516,524,553,574,599,627],{"__ignoreMap":513},[13,517,520],{"class":518,"line":519},"line",1,[13,521,523],{"class":522},"sJ8bj","\u002F\u002F gpu\u002Fcommand_buffer\u002Fservice\u002Flogger.cc (Logger::Logger; signature condensed)\n",[13,525,527,531,535,537,540,544,547,550],{"class":518,"line":526},2,[13,528,530],{"class":529},"sScJk","Logger",[13,532,534],{"class":533},"sVt8B","::",[13,536,530],{"class":529},[13,538,539],{"class":533},"(",[13,541,543],{"class":542},"szBVR","const",[13,545,546],{"class":533}," DebugMarkerManager",[13,548,549],{"class":542},"*",[13,551,552],{"class":533}," debug_marker_manager, ...) {\n",[13,554,556,559,561,564,567,571],{"class":518,"line":555},3,[13,557,558],{"class":529},"    Logger",[13,560,549],{"class":542},[13,562,563],{"class":533}," this_temp ",[13,565,566],{"class":542},"=",[13,568,570],{"class":569},"sj4cs"," this",[13,572,573],{"class":533},";\n",[13,575,577,580,582,585,587,590,592,596],{"class":518,"line":576},4,[13,578,579],{"class":533},"    this_in_hex_ ",[13,581,566],{"class":542},[13,583,584],{"class":529}," std",[13,586,534],{"class":533},[13,588,589],{"class":529},"string",[13,591,539],{"class":533},[13,593,595],{"class":594},"sZZnC","\"GroupMarkerNotSet(crbug.com\u002F242999)!:\"",[13,597,598],{"class":533},")\n",[13,600,602,605,608,610,613,615,618,621,624],{"class":518,"line":601},5,[13,603,604],{"class":542},"                   +",[13,606,607],{"class":529}," base",[13,609,534],{"class":533},[13,611,612],{"class":529},"HexEncode",[13,614,539],{"class":533},[13,616,617],{"class":542},"&",[13,619,620],{"class":533},"this_temp, ",[13,622,623],{"class":542},"sizeof",[13,625,626],{"class":533},"(this_temp));\n",[13,628,630],{"class":518,"line":629},6,[13,631,632],{"class":533},"}\n",[10,634,635],{},"This formats the Logger instance's address as a hex string. This string is prepended to every GL error message the Logger emits.",[10,637,638],{},"The renderer triggers a synthetic GL error via IPC by calling BeginQueryEXT(0). Since target 0 is invalid, the GPU dispatches an error:",[508,640,642],{"className":510,"code":641,"language":512,"meta":513,"style":513},"\u002F\u002F raster_decoder.cc, RasterDecoderImpl::HandleBeginQueryEXT\n\u002F\u002F (via the LOCAL_SET_GL_ERROR macro)\nerror_state_->SetGLError(GL_INVALID_ENUM, \"glBeginQueryEXT\",\n                         \"unknown query target\");\n",[437,643,644,649,654,671],{"__ignoreMap":513},[13,645,646],{"class":518,"line":519},[13,647,648],{"class":522},"\u002F\u002F raster_decoder.cc, RasterDecoderImpl::HandleBeginQueryEXT\n",[13,650,651],{"class":518,"line":526},[13,652,653],{"class":522},"\u002F\u002F (via the LOCAL_SET_GL_ERROR macro)\n",[13,655,656,659,662,665,668],{"class":518,"line":555},[13,657,658],{"class":533},"error_state_->",[13,660,661],{"class":529},"SetGLError",[13,663,664],{"class":533},"(GL_INVALID_ENUM, ",[13,666,667],{"class":594},"\"glBeginQueryEXT\"",[13,669,670],{"class":533},",\n",[13,672,673,676],{"class":518,"line":576},[13,674,675],{"class":594},"                         \"unknown query target\"",[13,677,678],{"class":533},");\n",[10,680,681],{},"So the renderer receives:",[508,683,688],{"className":684,"code":686,"language":687,"meta":513},[685],"language-text","[GroupMarkerNotSet(crbug.com\u002F242999)!:009B5C01DC1A0000]GL ERROR ...\n                                      ^^^^^^^^^^^^^^^^\n                                      HexEncode(&logger_)\n","text",[437,689,686],{"__ignoreMap":513},[449,691,693],{"id":692},"deriving-pool_base-and-decoder","Deriving pool_base and decoder",[10,695,696,697,765,766,856,857,985],{},"Logger lives in chromium's PartitionAlloc BRP pool. On 64-bit Linux, PA reserves the Regular and BRP pools as one glued 32 GiB region aligned to ",[13,698,700,720],{"className":699},[50],[13,701,703],{"className":702},[54],[56,704,705],{"xmlns":58},[60,706,707,717],{},[63,708,709],{},[710,711,712,714],"msup",{},[143,713,145],{},[143,715,716],{},"35",[70,718,719],{"encoding":72},"2^{35}",[13,721,723],{"className":722,"ariaHidden":77},[76],[13,724,726,730],{"className":725},[81],[13,727],{"className":728,"style":729},[85],"height:0.8141em;",[13,731,733,736],{"className":732},[90],[13,734,145],{"className":735},[90],[13,737,740],{"className":738},[739],"msupsub",[13,741,743],{"className":742},[188],[13,744,746],{"className":745},[193],[13,747,749],{"className":748,"style":729},[197],[13,750,752,756],{"style":751},"top:-3.063em;margin-right:0.05em;",[13,753],{"className":754,"style":755},[205],"height:2.7em;",[13,757,759],{"className":758},[210,211,212,213],[13,760,762],{"className":761},[90,213],[13,763,716],{"className":764},[90,213],", so masking the low 35 bits off the leaked address gives that region's base. Logger is also an embedded member of RasterDecoderImpl at a build-constant offset (",[13,767,769,794],{"className":768},[50],[13,770,772],{"className":771},[54],[56,773,774],{"xmlns":58},[60,775,776,791],{},[63,777,778,781],{},[147,779,780],{},"+",[782,783,784,788],"msub",{},[785,786,787],"mtext",{},"150",[143,789,790],{},"16",[70,792,793],{"encoding":72},"+\\text{150}_{16}",[13,795,797],{"className":796,"ariaHidden":77},[76],[13,798,800,804,807],{"className":799},[81],[13,801],{"className":802,"style":803},[85],"height:0.7944em;vertical-align:-0.15em;",[13,805,780],{"className":806},[90],[13,808,810,816],{"className":809},[90],[13,811,813],{"className":812},[90,687],[13,814,787],{"className":815},[90],[13,817,819],{"className":818},[739],[13,820,822,847],{"className":821},[188,189],[13,823,825,844],{"className":824},[193],[13,826,829],{"className":827,"style":828},[197],"height:0.3011em;",[13,830,832,835],{"style":831},"top:-2.55em;margin-right:0.05em;",[13,833],{"className":834,"style":755},[205],[13,836,838],{"className":837},[210,211,212,213],[13,839,841],{"className":840},[90,213],[13,842,790],{"className":843},[90,213],[13,845,250],{"className":846},[249],[13,848,850],{"className":849},[193],[13,851,854],{"className":852,"style":853},[197],"height:0.15em;",[13,855],{},") from the decoder base. From the single leaked ",[13,858,860,903],{"className":859},[50],[13,861,863],{"className":862},[54],[56,864,865],{"xmlns":58},[60,866,867,900],{},[63,868,869,872,891,893],{},[66,870,617],{"mathvariant":871},"normal",[63,873,874,877,880,883,885,888],{},[66,875,876],{"mathvariant":871},"L",[66,878,879],{"mathvariant":871},"o",[66,881,882],{"mathvariant":871},"g",[66,884,882],{"mathvariant":871},[66,886,887],{"mathvariant":871},"e",[66,889,890],{"mathvariant":871},"r",[147,892,566],{},[782,894,895,898],{},[785,896,897],{},"1ADC015C9B00",[143,899,790],{},[70,901,902],{"encoding":72},"\\&\\mathrm{Logger} = \\text{1ADC015C9B00}_{16}",[13,904,906,932],{"className":905,"ariaHidden":77},[76],[13,907,909,913,916,923,926,929],{"className":908},[81],[13,910],{"className":911,"style":912},[85],"height:0.8889em;vertical-align:-0.1944em;",[13,914,617],{"className":915},[90],[13,917,919],{"className":918},[90],[13,920,530],{"className":921},[90,922],"mathrm",[13,924],{"className":925,"style":268},[267],[13,927,566],{"className":928},[272],[13,930],{"className":931,"style":268},[267],[13,933,935,939],{"className":934},[81],[13,936],{"className":937,"style":938},[85],"height:0.8333em;vertical-align:-0.15em;",[13,940,942,948],{"className":941},[90],[13,943,945],{"className":944},[90,687],[13,946,897],{"className":947},[90],[13,949,951],{"className":950},[739],[13,952,954,977],{"className":953},[188,189],[13,955,957,974],{"className":956},[193],[13,958,960],{"className":959,"style":828},[197],[13,961,962,965],{"style":831},[13,963],{"className":964,"style":755},[205],[13,966,968],{"className":967},[210,211,212,213],[13,969,971],{"className":970},[90,213],[13,972,790],{"className":973},[90,213],[13,975,250],{"className":976},[249],[13,978,980],{"className":979},[193],[13,981,983],{"className":982,"style":853},[197],[13,984],{},":",[13,987,990],{"className":988},[989],"katex-display",[13,991,993,1344],{"className":992},[50],[13,994,996],{"className":995},[54],[56,997,999],{"xmlns":58,"display":998},"block",[60,1000,1001,1341],{},[1002,1003,1007,1099,1132,1174,1257],"mtable",{"rowspacing":1004,"columnalign":1005,"columnspacing":1006},"0.25em","right left right left","0em 1em 0em",[1008,1009,1010,1042],"mtr",{},[1011,1012,1013],"mtd",{},[1014,1015,1017],"mstyle",{"scriptlevel":1016,"displaystyle":77},"0",[63,1018,1019,1021,1023,1025,1028,1031,1034,1037,1040],{},[66,1020,10],{"mathvariant":871},[66,1022,879],{"mathvariant":871},[66,1024,879],{"mathvariant":871},[66,1026,1027],{"mathvariant":871},"l",[66,1029,1030],{"mathvariant":871},"_",[66,1032,1033],{"mathvariant":871},"b",[66,1035,1036],{"mathvariant":871},"a",[66,1038,1039],{"mathvariant":871},"s",[66,1041,887],{"mathvariant":871},[1011,1043,1044],{},[1014,1045,1046],{"scriptlevel":1016,"displaystyle":77},[63,1047,1048,1050,1052,1054,1068,1071,1074,1077,1081,1083,1086,1089,1091,1093,1095,1097],{},[63,1049],{},[147,1051,566],{},[66,1053,617],{"mathvariant":871},[63,1055,1056,1058,1060,1062,1064,1066],{},[66,1057,876],{"mathvariant":871},[66,1059,879],{"mathvariant":871},[66,1061,882],{"mathvariant":871},[66,1063,882],{"mathvariant":871},[66,1065,887],{"mathvariant":871},[66,1067,890],{"mathvariant":871},[147,1069,617],{"mathvariant":871,"lspace":1070,"rspace":1070},"0.22em",[147,1072,1073],{},"∼",[785,1075,1076],{}," ⁣",[147,1078,539],{"fence":1079,"stretchy":77,"minsize":1080,"maxsize":1080},"false","1.2em",[147,1082,539],{"stretchy":1079},[143,1084,1085],{},"1",[147,1087,1088],{},"≪",[143,1090,716],{},[147,1092,440],{"stretchy":1079},[147,1094,329],{},[143,1096,1085],{},[147,1098,440],{"fence":1079,"stretchy":77,"minsize":1080,"maxsize":1080},[1008,1100,1101,1107],{},[1011,1102,1103],{},[1014,1104,1105],{"scriptlevel":1016,"displaystyle":77},[63,1106],{},[1011,1108,1109],{},[1014,1110,1111],{"scriptlevel":1016,"displaystyle":77},[63,1112,1113,1115,1117,1123,1125],{},[63,1114],{},[147,1116,566],{},[782,1118,1119,1121],{},[785,1120,897],{},[143,1122,790],{},[147,1124,617],{"mathvariant":871,"lspace":1070,"rspace":1070},[782,1126,1127,1130],{},[785,1128,1129],{},"FFFFFFF800000000",[143,1131,790],{},[1008,1133,1134,1140,1157,1163],{},[1011,1135,1136],{},[1014,1137,1138],{"scriptlevel":1016,"displaystyle":77},[63,1139],{},[1011,1141,1142],{},[1014,1143,1144],{"scriptlevel":1016,"displaystyle":77},[63,1145,1146,1148,1150],{},[63,1147],{},[147,1149,566],{},[782,1151,1152,1155],{},[785,1153,1154],{},"1AD800000000",[143,1156,790],{},[1011,1158,1159],{},[1014,1160,1161],{"scriptlevel":1016,"displaystyle":77},[63,1162],{},[1011,1164,1165],{},[1014,1166,1167],{"scriptlevel":1016,"displaystyle":77},[63,1168,1169,1171],{},[63,1170],{},[785,1172,1173],{},"(cleared low 35 bits)",[1008,1175,1176,1199,1240,1246],{},[1011,1177,1178],{},[1014,1179,1180],{"scriptlevel":1016,"displaystyle":77},[63,1181,1182,1184,1186,1188,1190,1192,1195,1197],{},[66,1183,10],{"mathvariant":871},[66,1185,879],{"mathvariant":871},[66,1187,879],{"mathvariant":871},[66,1189,1027],{"mathvariant":871},[66,1191,1030],{"mathvariant":871},[66,1193,1194],{"mathvariant":871},"t",[66,1196,1036],{"mathvariant":871},[66,1198,882],{"mathvariant":871},[1011,1200,1201],{},[1014,1202,1203],{"scriptlevel":1016,"displaystyle":77},[63,1204,1205,1207,1209,1211,1225,1228,1231,1233],{},[63,1206],{},[147,1208,566],{},[66,1210,617],{"mathvariant":871},[63,1212,1213,1215,1217,1219,1221,1223],{},[66,1214,876],{"mathvariant":871},[66,1216,879],{"mathvariant":871},[66,1218,882],{"mathvariant":871},[66,1220,882],{"mathvariant":871},[66,1222,887],{"mathvariant":871},[66,1224,890],{"mathvariant":871},[147,1226,1227],{},"≫",[143,1229,1230],{},"32",[147,1232,566],{},[782,1234,1235,1238],{},[785,1236,1237],{},"1ADC",[143,1239,790],{},[1011,1241,1242],{},[1014,1243,1244],{"scriptlevel":1016,"displaystyle":77},[63,1245],{},[1011,1247,1248],{},[1014,1249,1250],{"scriptlevel":1016,"displaystyle":77},[63,1251,1252,1254],{},[63,1253],{},[785,1255,1256],{},"(top 16 bits)",[1008,1258,1259,1281,1324,1330],{},[1011,1260,1261],{},[1014,1262,1263],{"scriptlevel":1016,"displaystyle":77},[63,1264,1265,1268,1270,1273,1275,1277,1279],{},[66,1266,1267],{"mathvariant":871},"d",[66,1269,887],{"mathvariant":871},[66,1271,1272],{"mathvariant":871},"c",[66,1274,879],{"mathvariant":871},[66,1276,1267],{"mathvariant":871},[66,1278,887],{"mathvariant":871},[66,1280,890],{"mathvariant":871},[1011,1282,1283],{},[1014,1284,1285],{"scriptlevel":1016,"displaystyle":77},[63,1286,1287,1289,1291,1293,1307,1309,1315,1317],{},[63,1288],{},[147,1290,566],{},[66,1292,617],{"mathvariant":871},[63,1294,1295,1297,1299,1301,1303,1305],{},[66,1296,876],{"mathvariant":871},[66,1298,879],{"mathvariant":871},[66,1300,882],{"mathvariant":871},[66,1302,882],{"mathvariant":871},[66,1304,887],{"mathvariant":871},[66,1306,890],{"mathvariant":871},[147,1308,329],{},[782,1310,1311,1313],{},[785,1312,787],{},[143,1314,790],{},[147,1316,566],{},[782,1318,1319,1322],{},[785,1320,1321],{},"1ADC015C99B0",[143,1323,790],{},[1011,1325,1326],{},[1014,1327,1328],{"scriptlevel":1016,"displaystyle":77},[63,1329],{},[1011,1331,1332],{},[1014,1333,1334],{"scriptlevel":1016,"displaystyle":77},[63,1335,1336,1338],{},[63,1337],{},[785,1339,1340],{},"(decoder base)",[70,1342,1343],{"encoding":72},"\\begin{aligned}\n\\mathrm{pool\\_base} &= \\&\\mathrm{Logger} \\mathbin{\\&} \\sim\\!\\big((1 \\ll 35) - 1\\big) \\\\\n&= \\text{1ADC015C9B00}_{16} \\mathbin{\\&} \\text{FFFFFFF800000000}_{16} \\\\\n&= \\text{1AD800000000}_{16} &&\\text{(cleared low 35 bits)} \\\\[4pt]\n\\mathrm{pool\\_tag} &= \\&\\mathrm{Logger} \\gg 32 = \\text{1ADC}_{16} &&\\text{(top 16 bits)} \\\\[4pt]\n\\mathrm{decoder} &= \\&\\mathrm{Logger} - \\text{150}_{16} = \\text{1ADC015C99B0}_{16} &&\\text{(decoder base)}\n\\end{aligned}",[13,1345,1347],{"className":1346,"ariaHidden":77},[76],[13,1348,1350,1354],{"className":1349},[81],[13,1351],{"className":1352,"style":1353},[85],"height:8.01em;vertical-align:-3.755em;",[13,1355,1357],{"className":1356},[90],[13,1358,1360,1453,1997,2002,2054],{"className":1359},[1002],[13,1361,1364],{"className":1362},[1363],"col-align-r",[13,1365,1367,1444],{"className":1366},[188,189],[13,1368,1370,1441],{"className":1369},[193],[13,1371,1374,1390,1399,1408,1425],{"className":1372,"style":1373},[197],"height:4.255em;",[13,1375,1377,1380],{"style":1376},"top:-6.405em;",[13,1378],{"className":1379,"style":206},[205],[13,1381,1383],{"className":1382},[90],[13,1384,1386],{"className":1385},[90],[13,1387,1389],{"className":1388},[90,922],"pool_base",[13,1391,1393,1396],{"style":1392},"top:-4.905em;",[13,1394],{"className":1395,"style":206},[205],[13,1397],{"className":1398},[90],[13,1400,1402,1405],{"style":1401},"top:-3.405em;",[13,1403],{"className":1404,"style":206},[205],[13,1406],{"className":1407},[90],[13,1409,1411,1414],{"style":1410},"top:-1.505em;",[13,1412],{"className":1413,"style":206},[205],[13,1415,1417],{"className":1416},[90],[13,1418,1420],{"className":1419},[90],[13,1421,1424],{"className":1422,"style":1423},[90,922],"margin-right:0.0139em;","pool_tag",[13,1426,1428,1431],{"style":1427},"top:0.395em;",[13,1429],{"className":1430,"style":206},[205],[13,1432,1434],{"className":1433},[90],[13,1435,1437],{"className":1436},[90],[13,1438,1440],{"className":1439},[90,922],"decoder",[13,1442,250],{"className":1443},[249],[13,1445,1447],{"className":1446},[193],[13,1448,1451],{"className":1449,"style":1450},[197],"height:3.755em;",[13,1452],{},[13,1454,1457],{"className":1455},[1456],"col-align-l",[13,1458,1460,1989],{"className":1459},[188,189],[13,1461,1463,1986],{"className":1462},[193],[13,1464,1466,1561,1685,1751,1847],{"className":1465,"style":1373},[197],[13,1467,1468,1471],{"style":1376},[13,1469],{"className":1470,"style":206},[205],[13,1472,1474,1477,1480,1483,1486,1489,1495,1501,1504,1507,1511,1514,1522,1525,1528,1531,1534,1537,1540,1543,1546,1549,1552,1555],{"className":1473},[90],[13,1475],{"className":1476},[90],[13,1478],{"className":1479,"style":268},[267],[13,1481,566],{"className":1482},[272],[13,1484],{"className":1485,"style":268},[267],[13,1487,617],{"className":1488},[90],[13,1490,1492],{"className":1491},[90],[13,1493,530],{"className":1494},[90,922],[13,1496,1498],{"className":1497},[90],[13,1499,617],{"className":1500},[90],[13,1502],{"className":1503,"style":268},[267],[13,1505,1073],{"className":1506},[272],[13,1508],{"className":1509,"style":1510},[267],"margin-right:-0.1667em;",[13,1512],{"className":1513,"style":268},[267],[13,1515,1517],{"className":1516},[90],[13,1518,539],{"className":1519},[1520,1521],"delimsizing","size1",[13,1523,539],{"className":1524},[180],[13,1526,1085],{"className":1527},[90],[13,1529],{"className":1530,"style":268},[267],[13,1532,1088],{"className":1533},[272],[13,1535],{"className":1536,"style":268},[267],[13,1538,716],{"className":1539},[90],[13,1541,440],{"className":1542},[263],[13,1544],{"className":1545,"style":351},[267],[13,1547,329],{"className":1548},[355],[13,1550],{"className":1551,"style":351},[267],[13,1553,1085],{"className":1554},[90],[13,1556,1558],{"className":1557},[90],[13,1559,440],{"className":1560},[1520,1521],[13,1562,1563,1566],{"style":1392},[13,1564],{"className":1565,"style":206},[205],[13,1567,1569,1572,1575,1578,1581,1627,1630,1636,1639],{"className":1568},[90],[13,1570],{"className":1571},[90],[13,1573],{"className":1574,"style":268},[267],[13,1576,566],{"className":1577},[272],[13,1579],{"className":1580,"style":268},[267],[13,1582,1584,1590],{"className":1583},[90],[13,1585,1587],{"className":1586},[90,687],[13,1588,897],{"className":1589},[90],[13,1591,1593],{"className":1592},[739],[13,1594,1596,1619],{"className":1595},[188,189],[13,1597,1599,1616],{"className":1598},[193],[13,1600,1602],{"className":1601,"style":828},[197],[13,1603,1604,1607],{"style":831},[13,1605],{"className":1606,"style":755},[205],[13,1608,1610],{"className":1609},[210,211,212,213],[13,1611,1613],{"className":1612},[90,213],[13,1614,790],{"className":1615},[90,213],[13,1617,250],{"className":1618},[249],[13,1620,1622],{"className":1621},[193],[13,1623,1625],{"className":1624,"style":853},[197],[13,1626],{},[13,1628],{"className":1629,"style":351},[267],[13,1631,1633],{"className":1632},[355],[13,1634,617],{"className":1635},[90],[13,1637],{"className":1638,"style":351},[267],[13,1640,1642,1648],{"className":1641},[90],[13,1643,1645],{"className":1644},[90,687],[13,1646,1129],{"className":1647},[90],[13,1649,1651],{"className":1650},[739],[13,1652,1654,1677],{"className":1653},[188,189],[13,1655,1657,1674],{"className":1656},[193],[13,1658,1660],{"className":1659,"style":828},[197],[13,1661,1662,1665],{"style":831},[13,1663],{"className":1664,"style":755},[205],[13,1666,1668],{"className":1667},[210,211,212,213],[13,1669,1671],{"className":1670},[90,213],[13,1672,790],{"className":1673},[90,213],[13,1675,250],{"className":1676},[249],[13,1678,1680],{"className":1679},[193],[13,1681,1683],{"className":1682,"style":853},[197],[13,1684],{},[13,1686,1687,1690],{"style":1401},[13,1688],{"className":1689,"style":206},[205],[13,1691,1693,1696,1699,1702,1705],{"className":1692},[90],[13,1694],{"className":1695},[90],[13,1697],{"className":1698,"style":268},[267],[13,1700,566],{"className":1701},[272],[13,1703],{"className":1704,"style":268},[267],[13,1706,1708,1714],{"className":1707},[90],[13,1709,1711],{"className":1710},[90,687],[13,1712,1154],{"className":1713},[90],[13,1715,1717],{"className":1716},[739],[13,1718,1720,1743],{"className":1719},[188,189],[13,1721,1723,1740],{"className":1722},[193],[13,1724,1726],{"className":1725,"style":828},[197],[13,1727,1728,1731],{"style":831},[13,1729],{"className":1730,"style":755},[205],[13,1732,1734],{"className":1733},[210,211,212,213],[13,1735,1737],{"className":1736},[90,213],[13,1738,790],{"className":1739},[90,213],[13,1741,250],{"className":1742},[249],[13,1744,1746],{"className":1745},[193],[13,1747,1749],{"className":1748,"style":853},[197],[13,1750],{},[13,1752,1753,1756],{"style":1410},[13,1754],{"className":1755,"style":206},[205],[13,1757,1759,1762,1765,1768,1771,1774,1780,1783,1786,1789,1792,1795,1798,1801],{"className":1758},[90],[13,1760],{"className":1761},[90],[13,1763],{"className":1764,"style":268},[267],[13,1766,566],{"className":1767},[272],[13,1769],{"className":1770,"style":268},[267],[13,1772,617],{"className":1773},[90],[13,1775,1777],{"className":1776},[90],[13,1778,530],{"className":1779},[90,922],[13,1781],{"className":1782,"style":268},[267],[13,1784,1227],{"className":1785},[272],[13,1787],{"className":1788,"style":268},[267],[13,1790,1230],{"className":1791},[90],[13,1793],{"className":1794,"style":268},[267],[13,1796,566],{"className":1797},[272],[13,1799],{"className":1800,"style":268},[267],[13,1802,1804,1810],{"className":1803},[90],[13,1805,1807],{"className":1806},[90,687],[13,1808,1237],{"className":1809},[90],[13,1811,1813],{"className":1812},[739],[13,1814,1816,1839],{"className":1815},[188,189],[13,1817,1819,1836],{"className":1818},[193],[13,1820,1822],{"className":1821,"style":828},[197],[13,1823,1824,1827],{"style":831},[13,1825],{"className":1826,"style":755},[205],[13,1828,1830],{"className":1829},[210,211,212,213],[13,1831,1833],{"className":1832},[90,213],[13,1834,790],{"className":1835},[90,213],[13,1837,250],{"className":1838},[249],[13,1840,1842],{"className":1841},[193],[13,1843,1845],{"className":1844,"style":853},[197],[13,1846],{},[13,1848,1849,1852],{"style":1427},[13,1850],{"className":1851,"style":206},[205],[13,1853,1855,1858,1861,1864,1867,1870,1876,1879,1882,1885,1931,1934,1937,1940],{"className":1854},[90],[13,1856],{"className":1857},[90],[13,1859],{"className":1860,"style":268},[267],[13,1862,566],{"className":1863},[272],[13,1865],{"className":1866,"style":268},[267],[13,1868,617],{"className":1869},[90],[13,1871,1873],{"className":1872},[90],[13,1874,530],{"className":1875},[90,922],[13,1877],{"className":1878,"style":351},[267],[13,1880,329],{"className":1881},[355],[13,1883],{"className":1884,"style":351},[267],[13,1886,1888,1894],{"className":1887},[90],[13,1889,1891],{"className":1890},[90,687],[13,1892,787],{"className":1893},[90],[13,1895,1897],{"className":1896},[739],[13,1898,1900,1923],{"className":1899},[188,189],[13,1901,1903,1920],{"className":1902},[193],[13,1904,1906],{"className":1905,"style":828},[197],[13,1907,1908,1911],{"style":831},[13,1909],{"className":1910,"style":755},[205],[13,1912,1914],{"className":1913},[210,211,212,213],[13,1915,1917],{"className":1916},[90,213],[13,1918,790],{"className":1919},[90,213],[13,1921,250],{"className":1922},[249],[13,1924,1926],{"className":1925},[193],[13,1927,1929],{"className":1928,"style":853},[197],[13,1930],{},[13,1932],{"className":1933,"style":268},[267],[13,1935,566],{"className":1936},[272],[13,1938],{"className":1939,"style":268},[267],[13,1941,1943,1949],{"className":1942},[90],[13,1944,1946],{"className":1945},[90,687],[13,1947,1321],{"className":1948},[90],[13,1950,1952],{"className":1951},[739],[13,1953,1955,1978],{"className":1954},[188,189],[13,1956,1958,1975],{"className":1957},[193],[13,1959,1961],{"className":1960,"style":828},[197],[13,1962,1963,1966],{"style":831},[13,1964],{"className":1965,"style":755},[205],[13,1967,1969],{"className":1968},[210,211,212,213],[13,1970,1972],{"className":1971},[90,213],[13,1973,790],{"className":1974},[90,213],[13,1976,250],{"className":1977},[249],[13,1979,1981],{"className":1980},[193],[13,1982,1984],{"className":1983,"style":853},[197],[13,1985],{},[13,1987,250],{"className":1988},[249],[13,1990,1992],{"className":1991},[193],[13,1993,1995],{"className":1994,"style":1450},[197],[13,1996],{},[13,1998],{"className":1999,"style":2001},[2000],"arraycolsep","width:1em;",[13,2003,2005],{"className":2004},[1363],[13,2006,2008,2046],{"className":2007},[188,189],[13,2009,2011,2043],{"className":2010},[193],[13,2012,2015,2025,2034],{"className":2013,"style":2014},[197],"height:1.245em;",[13,2016,2018,2022],{"style":2017},"top:-3.245em;",[13,2019],{"className":2020,"style":2021},[205],"height:2.84em;",[13,2023],{"className":2024},[90],[13,2026,2028,2031],{"style":2027},"top:-1.345em;",[13,2029],{"className":2030,"style":2021},[205],[13,2032],{"className":2033},[90],[13,2035,2037,2040],{"style":2036},"top:0.555em;",[13,2038],{"className":2039,"style":2021},[205],[13,2041],{"className":2042},[90],[13,2044,250],{"className":2045},[249],[13,2047,2049],{"className":2048},[193],[13,2050,2052],{"className":2051,"style":1450},[197],[13,2053],{},[13,2055,2057],{"className":2056},[1456],[13,2058,2060,2120],{"className":2059},[188,189],[13,2061,2063,2117],{"className":2062},[193],[13,2064,2066,2083,2100],{"className":2065,"style":2014},[197],[13,2067,2068,2071],{"style":1401},[13,2069],{"className":2070,"style":206},[205],[13,2072,2074,2077],{"className":2073},[90],[13,2075],{"className":2076},[90],[13,2078,2080],{"className":2079},[90,687],[13,2081,1173],{"className":2082},[90],[13,2084,2085,2088],{"style":1410},[13,2086],{"className":2087,"style":206},[205],[13,2089,2091,2094],{"className":2090},[90],[13,2092],{"className":2093},[90],[13,2095,2097],{"className":2096},[90,687],[13,2098,1256],{"className":2099},[90],[13,2101,2102,2105],{"style":1427},[13,2103],{"className":2104,"style":206},[205],[13,2106,2108,2111],{"className":2107},[90],[13,2109],{"className":2110},[90],[13,2112,2114],{"className":2113},[90,687],[13,2115,1340],{"className":2116},[90],[13,2118,250],{"className":2119},[249],[13,2121,2123],{"className":2122},[193],[13,2124,2126],{"className":2125,"style":1450},[197],[13,2127],{},[487,2129,2130],{"type":489},[10,2131,2132],{},"One leaked heap address yields both the PA pool base and the decoder object. Every later pointer is computed from these two.",[10,2134,2135],{},"Now that we have derived the base address of the PartitionAlloc pool, we need to understand how the allocator arranges memory so we can manipulate it.",[29,2137,2139],{"id":2138},"partitionalloc-primer","PartitionAlloc primer",[10,2141,2142],{},"The chain manipulates PA at several points. Understanding the allocator's specific behavior is useful to follow.",[449,2144,2146],{"id":2145},"buckets","Buckets",[10,2148,2149],{},"PartitionAlloc segregates allocations by size class. Every allocation rounds up to a fixed bucket size under the root's bucket distribution. The GPU process, where this exploit runs, uses the kNeutral distribution.",[10,2151,2152],{},"PA manages memory by grouping allocations into size classes (buckets) using dedicated virtual memory regions for each size. Because an allocation's size class is permanently bound to its memory address, calling free(ptr) automatically routes the freed slot back to its original bucket. Thus, freeing a 56 KiB object instantly makes its slot available in that bucket's freelist, allowing us to reclaim and overwrite it by allocating another object of the exact same size.",[487,2154,2155],{"type":489},[10,2156,2157],{},"For an out-of-bounds write to hit a target object, both the source and the victim must be sized into the exact same bucket.",[449,2159,2161],{"id":2160},"slot-spans-and-adjacent-overflows","Slot spans and adjacent overflows",[10,2163,2164],{},"Depending on size, PartitionAlloc allocates memory in one of three regimes:",[466,2166,2167,2173,2179],{},[413,2168,2169,2172],{},[37,2170,2171],{},"Multi-slot spans",": smaller buckets (like 10240 B) pack multiple slots contiguous inside a single span.",[413,2174,2175,2178],{},[37,2176,2177],{},"Single-slot spans",": medium\u002Flarge buckets hold exactly one slot per span.",[413,2180,2181,2184],{},[37,2182,2183],{},"Direct-mapped",": allocations above ~960 KiB get dedicated virtual memory regions isolated by unmapped guard pages. An OOB write here triggers an immediate SIGSEGV.",[10,2186,2187],{},"To avoid guard pages, the exploit targets bucketed allocations. Specifically, it uses bucket-57344, which operates under the single-slot regime.",[2189,2190],"diagram-stack",{":items":2191,"title":2192,"direction":2193,"spanNote":2194},"[{\"label\":\"span A\",\"note\":\"reservation 64K, alloc \u003C 64K\"},{\"label\":\"span B\",\"note\":\"reservation 64K, alloc \u003C 64K\"},{\"label\":\"span C\",\"note\":\"reservation 64K, alloc \u003C 64K\"}]","Adjacent single-slot spans (same bucket)","horizontal","OOB WRITE",[10,2196,2197],{},"PartitionAlloc carves slot spans sequentially. On Linux, the allocator commits the entire 64 KiB reservation for each span, even when the allocation inside it is smaller. The committed but unused tail is fully writable. When an OOB write overflows span A's allocation, it crosses the 64 KiB boundary directly into span B without hitting any unmapped pages. Same-bucket sizing forces adjacent spans to share this corridor.",[10,2199,2200],{},"Note: the specific choice of bucket-57344 is flexible. We could target other buckets as well. However, if it is too small, you would need to deal with the thread cache (requiring a different grooming strategy). It must not be too big, or it will fall into the direct-mapped case.",[487,2202,2203],{"type":489},[10,2204,2205],{},"Allocations must stay bucketed, not direct-mapped, whose guard pages SIGSEGV. Linux commits the whole single-slot span, so an overflow crosses into the adjacent span, not an unmapped page.",[10,2207,2208],{},"Let's see how we can trigger the out-of-bounds write.",[29,2210,2212],{"id":2211},"the-vulnerability-and-the-oob-site","The vulnerability and the OOB site",[449,2214,2216],{"id":2215},"the-bug","The bug",[10,2218,2219],{},"This is a simple integer overflow bug.",[508,2221,2223],{"className":510,"code":2222,"language":512,"meta":513,"style":513},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FPathStencilCoverOp.cpp\n\u002F\u002F PathStencilCoverOp::onPrepare\nint maxTrianglesInFans = std::max(fTotalCombinedPathVerbCnt - 2, 0);\nint fanTriangleCount = 0;\nif (VertexWriter triangleVertexWriter =\n            vertexAlloc.lockWriter(\n                    sizeof(SkPoint), maxTrianglesInFans * 3)) {\n    for (auto [pathMatrix, path, color] : *fPathDrawList) {\n        tess::AffineMatrix m(pathMatrix);\n        for (tess::PathMiddleOutFanIter it(path); !it.done();) {\n            for (auto [p0, p1, p2] : it.nextStack()) {\n                triangleVertexWriter \u003C\u003C m.map2Points(p0, p1)\n                                     \u003C\u003C m.mapPoint(p2);\n                ++fanTriangleCount;\n            }\n        }\n    }\n}\n",[437,2224,2225,2230,2235,2268,2282,2293,2304,2321,2341,2358,2392,2411,2429,2443,2452,2458,2464,2470],{"__ignoreMap":513},[13,2226,2227],{"class":518,"line":519},[13,2228,2229],{"class":522},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FPathStencilCoverOp.cpp\n",[13,2231,2232],{"class":518,"line":526},[13,2233,2234],{"class":522},"\u002F\u002F PathStencilCoverOp::onPrepare\n",[13,2236,2237,2240,2243,2245,2247,2249,2252,2255,2258,2261,2264,2266],{"class":518,"line":555},[13,2238,2239],{"class":542},"int",[13,2241,2242],{"class":533}," maxTrianglesInFans ",[13,2244,566],{"class":542},[13,2246,584],{"class":529},[13,2248,534],{"class":533},[13,2250,2251],{"class":529},"max",[13,2253,2254],{"class":533},"(fTotalCombinedPathVerbCnt ",[13,2256,2257],{"class":542},"-",[13,2259,2260],{"class":569}," 2",[13,2262,2263],{"class":533},", ",[13,2265,1016],{"class":569},[13,2267,678],{"class":533},[13,2269,2270,2272,2275,2277,2280],{"class":518,"line":576},[13,2271,2239],{"class":542},[13,2273,2274],{"class":533}," fanTriangleCount ",[13,2276,566],{"class":542},[13,2278,2279],{"class":569}," 0",[13,2281,573],{"class":533},[13,2283,2284,2287,2290],{"class":518,"line":601},[13,2285,2286],{"class":542},"if",[13,2288,2289],{"class":533}," (VertexWriter triangleVertexWriter ",[13,2291,2292],{"class":542},"=\n",[13,2294,2295,2298,2301],{"class":518,"line":629},[13,2296,2297],{"class":533},"            vertexAlloc.",[13,2299,2300],{"class":529},"lockWriter",[13,2302,2303],{"class":533},"(\n",[13,2305,2307,2310,2313,2315,2318],{"class":518,"line":2306},7,[13,2308,2309],{"class":542},"                    sizeof",[13,2311,2312],{"class":533},"(SkPoint), maxTrianglesInFans ",[13,2314,549],{"class":542},[13,2316,2317],{"class":569}," 3",[13,2319,2320],{"class":533},")) {\n",[13,2322,2324,2327,2330,2333,2336,2338],{"class":518,"line":2323},8,[13,2325,2326],{"class":542},"    for",[13,2328,2329],{"class":533}," (",[13,2331,2332],{"class":542},"auto",[13,2334,2335],{"class":533}," [pathMatrix, path, color] : ",[13,2337,549],{"class":542},[13,2339,2340],{"class":533},"fPathDrawList) {\n",[13,2342,2344,2347,2349,2352,2355],{"class":518,"line":2343},9,[13,2345,2346],{"class":529},"        tess",[13,2348,534],{"class":533},[13,2350,2351],{"class":529},"AffineMatrix",[13,2353,2354],{"class":529}," m",[13,2356,2357],{"class":533},"(pathMatrix);\n",[13,2359,2361,2364,2366,2369,2371,2374,2377,2380,2383,2386,2389],{"class":518,"line":2360},10,[13,2362,2363],{"class":542},"        for",[13,2365,2329],{"class":533},[13,2367,2368],{"class":529},"tess",[13,2370,534],{"class":533},[13,2372,2373],{"class":529},"PathMiddleOutFanIter",[13,2375,2376],{"class":529}," it",[13,2378,2379],{"class":533},"(path); ",[13,2381,2382],{"class":542},"!",[13,2384,2385],{"class":533},"it.",[13,2387,2388],{"class":529},"done",[13,2390,2391],{"class":533},"();) {\n",[13,2393,2395,2398,2400,2402,2405,2408],{"class":518,"line":2394},11,[13,2396,2397],{"class":542},"            for",[13,2399,2329],{"class":533},[13,2401,2332],{"class":542},[13,2403,2404],{"class":533}," [p0, p1, p2] : it.",[13,2406,2407],{"class":529},"nextStack",[13,2409,2410],{"class":533},"()) {\n",[13,2412,2414,2417,2420,2423,2426],{"class":518,"line":2413},12,[13,2415,2416],{"class":533},"                triangleVertexWriter ",[13,2418,2419],{"class":542},"\u003C\u003C",[13,2421,2422],{"class":533}," m.",[13,2424,2425],{"class":529},"map2Points",[13,2427,2428],{"class":533},"(p0, p1)\n",[13,2430,2432,2435,2437,2440],{"class":518,"line":2431},13,[13,2433,2434],{"class":542},"                                     \u003C\u003C",[13,2436,2422],{"class":533},[13,2438,2439],{"class":529},"mapPoint",[13,2441,2442],{"class":533},"(p2);\n",[13,2444,2446,2449],{"class":518,"line":2445},14,[13,2447,2448],{"class":542},"                ++",[13,2450,2451],{"class":533},"fanTriangleCount;\n",[13,2453,2455],{"class":518,"line":2454},15,[13,2456,2457],{"class":533},"            }\n",[13,2459,2461],{"class":518,"line":2460},16,[13,2462,2463],{"class":533},"        }\n",[13,2465,2467],{"class":518,"line":2466},17,[13,2468,2469],{"class":533},"    }\n",[13,2471,2473],{"class":518,"line":2472},18,[13,2474,632],{"class":533},[10,2476,2477],{},"fTotalCombinedPathVerbCnt is an int32_t. If we send a draw batch where (verbs - 2) * 3 overflows, maxTrianglesInFans * 3 wraps to a small positive number. The lockWriter function allocates a small vertex block, but the emission loop writes the true number of triangles, blowing past the buffer's end.",[10,2479,2480],{},"The next issue is how can we ship a big number of vertices without triggering the out-of-memory killer.",[449,2482,2484],{"id":2483},"the-math","The math",[13,2486,2488],{"className":2487},[989],[13,2489,2491,2720],{"className":2490},[50],[13,2492,2494],{"className":2493},[54],[56,2495,2496],{"xmlns":58,"display":998},[60,2497,2498,2717],{},[1002,2499,2500,2557,2632,2653],{"rowspacing":1004,"columnalign":1005,"columnspacing":1006},[1008,2501,2502,2535],{},[1011,2503,2504],{},[1014,2505,2506],{"scriptlevel":1016,"displaystyle":77},[63,2507,2508,2511,2513,2515,2517,2519,2522,2524,2527,2529,2531,2533],{},[66,2509,2510],{"mathvariant":871},"m",[66,2512,1036],{"mathvariant":871},[66,2514,68],{"mathvariant":871},[66,2516,17],{"mathvariant":871},[66,2518,890],{"mathvariant":871},[66,2520,2521],{"mathvariant":871},"i",[66,2523,1036],{"mathvariant":871},[66,2525,2526],{"mathvariant":871},"n",[66,2528,882],{"mathvariant":871},[66,2530,1027],{"mathvariant":871},[66,2532,887],{"mathvariant":871},[66,2534,1039],{"mathvariant":871},[1011,2536,2537],{},[1014,2538,2539],{"scriptlevel":1016,"displaystyle":77},[63,2540,2541,2543,2545,2548,2550,2552,2554],{},[63,2542],{},[147,2544,566],{},[66,2546,2547],{},"V",[147,2549,329],{},[143,2551,145],{},[147,2553,566],{},[143,2555,2556],{},"1,431,657,140",[1008,2558,2559,2590],{},[1011,2560,2561],{},[1014,2562,2563],{"scriptlevel":1016,"displaystyle":77},[63,2564,2565,2568,2570,2572,2574,2576,2578,2581,2583,2586,2588],{},[66,2566,2567],{"mathvariant":871},"v",[66,2569,887],{"mathvariant":871},[66,2571,890],{"mathvariant":871},[66,2573,1194],{"mathvariant":871},[66,2575,887],{"mathvariant":871},[66,2577,68],{"mathvariant":871},[66,2579,2580],{"mathvariant":871},"C",[66,2582,879],{"mathvariant":871},[66,2584,2585],{"mathvariant":871},"u",[66,2587,2526],{"mathvariant":871},[66,2589,1194],{"mathvariant":871},[1011,2591,2592],{},[1014,2593,2594],{"scriptlevel":1016,"displaystyle":77},[63,2595,2596,2598,2600,2626,2629],{},[63,2597],{},[147,2599,566],{},[63,2601,2602,2604,2606,2608,2610,2612,2614,2616,2618,2620,2622,2624],{},[66,2603,2510],{"mathvariant":871},[66,2605,1036],{"mathvariant":871},[66,2607,68],{"mathvariant":871},[66,2609,17],{"mathvariant":871},[66,2611,890],{"mathvariant":871},[66,2613,2521],{"mathvariant":871},[66,2615,1036],{"mathvariant":871},[66,2617,2526],{"mathvariant":871},[66,2619,882],{"mathvariant":871},[66,2621,1027],{"mathvariant":871},[66,2623,887],{"mathvariant":871},[66,2625,1039],{"mathvariant":871},[147,2627,2628],{},"⋅",[143,2630,2631],{},"3",[1008,2633,2634,2640],{},[1011,2635,2636],{},[1014,2637,2638],{"scriptlevel":1016,"displaystyle":77},[63,2639],{},[1011,2641,2642],{},[1014,2643,2644],{"scriptlevel":1016,"displaystyle":77},[63,2645,2646,2648,2650],{},[63,2647],{},[147,2649,566],{},[143,2651,2652],{},"4,294,971,420",[1008,2654,2655,2661,2700,2706],{},[1011,2656,2657],{},[1014,2658,2659],{"scriptlevel":1016,"displaystyle":77},[63,2660],{},[1011,2662,2663],{},[1014,2664,2665],{"scriptlevel":1016,"displaystyle":77},[63,2666,2667,2669,2671,2674,2676,2679,2681,2689,2692,2698],{},[63,2668],{},[147,2670,566],{},[143,2672,2673],{},"4,124",[267,2675],{},[267,2677],{"width":2678},"1em",[147,2680,539],{"stretchy":1079},[63,2682,2683,2685,2687],{},[66,2684,2510],{"mathvariant":871},[66,2686,879],{"mathvariant":871},[66,2688,1267],{"mathvariant":871},[267,2690],{"width":2691},"0.3333em",[710,2693,2694,2696],{},[143,2695,145],{},[143,2697,1230],{},[147,2699,440],{"stretchy":1079},[1011,2701,2702],{},[1014,2703,2704],{"scriptlevel":1016,"displaystyle":77},[63,2705],{},[1011,2707,2708],{},[1014,2709,2710],{"scriptlevel":1016,"displaystyle":77},[63,2711,2712,2714],{},[63,2713],{},[785,2715,2716],{},"(int32 overflow)",[70,2718,2719],{"encoding":72},"\\begin{aligned}\n\\mathrm{maxTriangles} &= V - 2 = 1{,}431{,}657{,}140 \\\\\n\\mathrm{vertexCount} &= \\mathrm{maxTriangles} \\cdot 3 \\\\\n&= 4{,}294{,}971{,}420 \\\\\n&= 4{,}124 \\pmod{2^{32}} &&\\text{(int32 overflow)}\n\\end{aligned}",[13,2721,2723],{"className":2722,"ariaHidden":77},[76],[13,2724,2726,2730],{"className":2725},[81],[13,2727],{"className":2728,"style":2729},[85],"height:5.7241em;vertical-align:-2.6121em;",[13,2731,2733],{"className":2732},[90],[13,2734,2736,2811,3098,3101,3135],{"className":2735},[1002],[13,2737,2739],{"className":2738},[1363],[13,2740,2742,2802],{"className":2741},[188,189],[13,2743,2745,2799],{"className":2744},[193],[13,2746,2749,2765,2781,2790],{"className":2747,"style":2748},[197],"height:3.1121em;",[13,2750,2752,2755],{"style":2751},"top:-5.2721em;",[13,2753],{"className":2754,"style":206},[205],[13,2756,2758],{"className":2757},[90],[13,2759,2761],{"className":2760},[90],[13,2762,2764],{"className":2763},[90,922],"maxTriangles",[13,2766,2768,2771],{"style":2767},"top:-3.7721em;",[13,2769],{"className":2770,"style":206},[205],[13,2772,2774],{"className":2773},[90],[13,2775,2777],{"className":2776},[90],[13,2778,2780],{"className":2779},[90,922],"vertexCount",[13,2782,2784,2787],{"style":2783},"top:-2.2721em;",[13,2785],{"className":2786,"style":206},[205],[13,2788],{"className":2789},[90],[13,2791,2793,2796],{"style":2792},"top:-0.7479em;",[13,2794],{"className":2795,"style":206},[205],[13,2797],{"className":2798},[90],[13,2800,250],{"className":2801},[249],[13,2803,2805],{"className":2804},[193],[13,2806,2809],{"className":2807,"style":2808},[197],"height:2.6121em;",[13,2810],{},[13,2812,2814],{"className":2813},[1456],[13,2815,2817,3090],{"className":2816},[188,189],[13,2818,2820,3087],{"className":2819},[193],[13,2821,2823,2900,2938,2992],{"className":2822,"style":2748},[197],[13,2824,2825,2828],{"style":2751},[13,2826],{"className":2827,"style":206},[205],[13,2829,2831,2834,2837,2840,2843,2846,2849,2852,2855,2858,2861,2864,2867,2870,2876,2880,2886,2890,2896],{"className":2830},[90],[13,2832],{"className":2833},[90],[13,2835],{"className":2836,"style":268},[267],[13,2838,566],{"className":2839},[272],[13,2841],{"className":2842,"style":268},[267],[13,2844,2547],{"className":2845,"style":351},[90,91],[13,2847],{"className":2848,"style":351},[267],[13,2850,329],{"className":2851},[355],[13,2853],{"className":2854,"style":351},[267],[13,2856,145],{"className":2857},[90],[13,2859],{"className":2860,"style":268},[267],[13,2862,566],{"className":2863},[272],[13,2865],{"className":2866,"style":268},[267],[13,2868,1085],{"className":2869},[90],[13,2871,2873],{"className":2872},[90],[13,2874,160],{"className":2875},[311],[13,2877,2879],{"className":2878},[90],"431",[13,2881,2883],{"className":2882},[90],[13,2884,160],{"className":2885},[311],[13,2887,2889],{"className":2888},[90],"657",[13,2891,2893],{"className":2892},[90],[13,2894,160],{"className":2895},[311],[13,2897,2899],{"className":2898},[90],"140",[13,2901,2902,2905],{"style":2767},[13,2903],{"className":2904,"style":206},[205],[13,2906,2908,2911,2914,2917,2920,2926,2929,2932,2935],{"className":2907},[90],[13,2909],{"className":2910},[90],[13,2912],{"className":2913,"style":268},[267],[13,2915,566],{"className":2916},[272],[13,2918],{"className":2919,"style":268},[267],[13,2921,2923],{"className":2922},[90],[13,2924,2764],{"className":2925},[90,922],[13,2927],{"className":2928,"style":351},[267],[13,2930,2628],{"className":2931},[355],[13,2933],{"className":2934,"style":351},[267],[13,2936,2631],{"className":2937},[90],[13,2939,2940,2943],{"style":2783},[13,2941],{"className":2942,"style":206},[205],[13,2944,2946,2949,2952,2955,2958,2962,2968,2972,2978,2982,2988],{"className":2945},[90],[13,2947],{"className":2948},[90],[13,2950],{"className":2951,"style":268},[267],[13,2953,566],{"className":2954},[272],[13,2956],{"className":2957,"style":268},[267],[13,2959,2961],{"className":2960},[90],"4",[13,2963,2965],{"className":2964},[90],[13,2966,160],{"className":2967},[311],[13,2969,2971],{"className":2970},[90],"294",[13,2973,2975],{"className":2974},[90],[13,2976,160],{"className":2977},[311],[13,2979,2981],{"className":2980},[90],"971",[13,2983,2985],{"className":2984},[90],[13,2986,160],{"className":2987},[311],[13,2989,2991],{"className":2990},[90],"420",[13,2993,2994,2997],{"style":2792},[13,2995],{"className":2996,"style":206},[205],[13,2998,3000,3003,3006,3009,3012,3015,3021,3025,3029,3033,3036,3046,3050,3084],{"className":2999},[90],[13,3001],{"className":3002},[90],[13,3004],{"className":3005,"style":268},[267],[13,3007,566],{"className":3008},[272],[13,3010],{"className":3011,"style":268},[267],[13,3013,2961],{"className":3014},[90],[13,3016,3018],{"className":3017},[90],[13,3019,160],{"className":3020},[311],[13,3022,3024],{"className":3023},[90],"124",[13,3026],{"className":3027},[267,3028],"allowbreak",[13,3030],{"className":3031,"style":3032},[267],"margin-right:1em;",[13,3034,539],{"className":3035},[180],[13,3037,3039],{"className":3038},[90],[13,3040,3042],{"className":3041},[90],[13,3043,3045],{"className":3044},[90,922],"mod",[13,3047],{"className":3048,"style":3049},[267],"margin-right:0.3333em;",[13,3051,3053,3056],{"className":3052},[90],[13,3054,145],{"className":3055},[90],[13,3057,3059],{"className":3058},[739],[13,3060,3062],{"className":3061},[188],[13,3063,3065],{"className":3064},[193],[13,3066,3069],{"className":3067,"style":3068},[197],"height:0.8641em;",[13,3070,3072,3075],{"style":3071},"top:-3.113em;margin-right:0.05em;",[13,3073],{"className":3074,"style":755},[205],[13,3076,3078],{"className":3077},[210,211,212,213],[13,3079,3081],{"className":3080},[90,213],[13,3082,1230],{"className":3083},[90,213],[13,3085,440],{"className":3086},[263],[13,3088,250],{"className":3089},[249],[13,3091,3093],{"className":3092},[193],[13,3094,3096],{"className":3095,"style":2808},[197],[13,3097],{},[13,3099],{"className":3100,"style":2001},[2000],[13,3102,3104],{"className":3103},[1363],[13,3105,3107,3127],{"className":3106},[188,189],[13,3108,3110,3124],{"className":3109},[193],[13,3111,3114],{"className":3112,"style":3113},[197],"height:-1.3879em;",[13,3115,3117,3121],{"style":3116},"top:-0.6121em;",[13,3118],{"className":3119,"style":3120},[205],"height:2.8641em;",[13,3122],{"className":3123},[90],[13,3125,250],{"className":3126},[249],[13,3128,3130],{"className":3129},[193],[13,3131,3133],{"className":3132,"style":2808},[197],[13,3134],{},[13,3136,3138],{"className":3137},[1456],[13,3139,3141,3167],{"className":3140},[188,189],[13,3142,3144,3164],{"className":3143},[193],[13,3145,3147],{"className":3146,"style":3113},[197],[13,3148,3149,3152],{"style":2792},[13,3150],{"className":3151,"style":206},[205],[13,3153,3155,3158],{"className":3154},[90],[13,3156],{"className":3157},[90],[13,3159,3161],{"className":3160},[90,687],[13,3162,2716],{"className":3163},[90],[13,3165,250],{"className":3166},[249],[13,3168,3170],{"className":3169},[193],[13,3171,3173],{"className":3172,"style":2808},[197],[13,3174],{},[13,3176,3178],{"className":3177},[989],[13,3179,3181,3356],{"className":3180},[50],[13,3182,3184],{"className":3183},[54],[56,3185,3186],{"xmlns":58,"display":998},[60,3187,3188,3353],{},[1002,3189,3192,3252,3331],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},"right left","0em",[1008,3193,3194,3225],{},[1011,3195,3196],{},[1014,3197,3198],{"scriptlevel":1016,"displaystyle":77},[63,3199,3200,3202,3204,3207,3209,3211,3213,3215,3218,3220,3223],{},[66,3201,890],{"mathvariant":871},[66,3203,887],{"mathvariant":871},[66,3205,3206],{"mathvariant":871},"q",[66,3208,2585],{"mathvariant":871},[66,3210,887],{"mathvariant":871},[66,3212,1039],{"mathvariant":871},[66,3214,1194],{"mathvariant":871},[66,3216,3217],{"mathvariant":871},"S",[66,3219,2521],{"mathvariant":871},[66,3221,3222],{"mathvariant":871},"z",[66,3224,887],{"mathvariant":871},[1011,3226,3227],{},[1014,3228,3229],{"scriptlevel":1016,"displaystyle":77},[63,3230,3231,3233,3235,3237,3239,3242,3245,3247,3250],{},[63,3232],{},[147,3234,566],{},[143,3236,2673],{},[147,3238,2628],{},[143,3240,3241],{},"8",[785,3243,3244],{}," bytes",[147,3246,566],{},[143,3248,3249],{},"32,992",[785,3251,3244],{},[1008,3253,3254,3289],{},[1011,3255,3256],{},[1014,3257,3258],{"scriptlevel":1016,"displaystyle":77},[63,3259,3260,3263,3266,3269,3271,3273,3275,3277,3279,3281,3283,3285,3287],{},[66,3261,3262],{"mathvariant":871},"P",[66,3264,3265],{"mathvariant":871},"A",[785,3267,3268],{}," ",[66,3270,1036],{"mathvariant":871},[66,3272,1027],{"mathvariant":871},[66,3274,1027],{"mathvariant":871},[66,3276,879],{"mathvariant":871},[66,3278,1272],{"mathvariant":871},[66,3280,1036],{"mathvariant":871},[66,3282,1194],{"mathvariant":871},[66,3284,2521],{"mathvariant":871},[66,3286,879],{"mathvariant":871},[66,3288,2526],{"mathvariant":871},[1011,3290,3291],{},[1014,3292,3293],{"scriptlevel":1016,"displaystyle":77},[63,3294,3295,3297,3299,3302,3304,3306,3309,3311,3313,3315,3317,3319,3322,3324,3326,3329],{},[63,3296],{},[147,3298,566],{},[143,3300,3301],{},"49,152",[785,3303,3268],{},[147,3305,539],{"stretchy":1079},[785,3307,3308],{},"Skia bin",[147,3310,440],{"stretchy":1079},[147,3312,780],{},[143,3314,1230],{},[785,3316,3268],{},[147,3318,539],{"stretchy":1079},[785,3320,3321],{},"metadata",[147,3323,440],{"stretchy":1079},[147,3325,566],{},[143,3327,3328],{},"49,184",[785,3330,3244],{},[1008,3332,3333,3339],{},[1011,3334,3335],{},[1014,3336,3337],{"scriptlevel":1016,"displaystyle":77},[63,3338],{},[1011,3340,3341],{},[1014,3342,3343],{"scriptlevel":1016,"displaystyle":77},[63,3344,3345,3347,3350],{},[63,3346],{},[147,3348,3349],{},"→",[785,3351,3352],{},"bucket-57344",[70,3354,3355],{"encoding":72},"\\begin{aligned}\n\\mathrm{requestSize} &= 4{,}124 \\cdot 8\\ \\text{bytes} = 32{,}992\\ \\text{bytes} \\\\\n\\mathrm{PA\\ allocation} &= 49{,}152\\ (\\text{Skia bin}) + 32\\ (\\text{metadata}) = 49{,}184\\ \\text{bytes} \\\\\n&\\to \\text{bucket-57344}\n\\end{aligned}",[13,3357,3359],{"className":3358,"ariaHidden":77},[76],[13,3360,3362,3366],{"className":3361},[81],[13,3363],{"className":3364,"style":3365},[85],"height:4.2em;vertical-align:-1.85em;",[13,3367,3369],{"className":3368},[90],[13,3370,3372,3445],{"className":3371},[1002],[13,3373,3375],{"className":3374},[1363],[13,3376,3378,3436],{"className":3377},[188,189],[13,3379,3381,3433],{"className":3380},[193],[13,3382,3385,3401,3424],{"className":3383,"style":3384},[197],"height:2.35em;",[13,3386,3388,3391],{"style":3387},"top:-4.51em;",[13,3389],{"className":3390,"style":206},[205],[13,3392,3394],{"className":3393},[90],[13,3395,3397],{"className":3396},[90],[13,3398,3400],{"className":3399},[90,922],"requestSize",[13,3402,3404,3407],{"style":3403},"top:-3.01em;",[13,3405],{"className":3406,"style":206},[205],[13,3408,3410],{"className":3409},[90],[13,3411,3413,3417,3420],{"className":3412},[90],[13,3414,3416],{"className":3415},[90,922],"PA",[13,3418,3268],{"className":3419},[267],[13,3421,3423],{"className":3422},[90,922],"allocation",[13,3425,3427,3430],{"style":3426},"top:-1.51em;",[13,3428],{"className":3429,"style":206},[205],[13,3431],{"className":3432},[90],[13,3434,250],{"className":3435},[249],[13,3437,3439],{"className":3438},[193],[13,3440,3443],{"className":3441,"style":3442},[197],"height:1.85em;",[13,3444],{},[13,3446,3448],{"className":3447},[1456],[13,3449,3451,3678],{"className":3450},[188,189],[13,3452,3454,3675],{"className":3453},[193],[13,3455,3457,3542,3649],{"className":3456,"style":3384},[197],[13,3458,3459,3462],{"style":3387},[13,3460],{"className":3461,"style":206},[205],[13,3463,3465,3468,3471,3474,3477,3480,3486,3489,3492,3495,3498,3501,3504,3511,3514,3517,3520,3523,3529,3533,3536],{"className":3464},[90],[13,3466],{"className":3467},[90],[13,3469],{"className":3470,"style":268},[267],[13,3472,566],{"className":3473},[272],[13,3475],{"className":3476,"style":268},[267],[13,3478,2961],{"className":3479},[90],[13,3481,3483],{"className":3482},[90],[13,3484,160],{"className":3485},[311],[13,3487,3024],{"className":3488},[90],[13,3490],{"className":3491,"style":351},[267],[13,3493,2628],{"className":3494},[355],[13,3496],{"className":3497,"style":351},[267],[13,3499,3241],{"className":3500},[90],[13,3502,3268],{"className":3503},[267],[13,3505,3507],{"className":3506},[90,687],[13,3508,3510],{"className":3509},[90],"bytes",[13,3512],{"className":3513,"style":268},[267],[13,3515,566],{"className":3516},[272],[13,3518],{"className":3519,"style":268},[267],[13,3521,1230],{"className":3522},[90],[13,3524,3526],{"className":3525},[90],[13,3527,160],{"className":3528},[311],[13,3530,3532],{"className":3531},[90],"992",[13,3534,3268],{"className":3535},[267],[13,3537,3539],{"className":3538},[90,687],[13,3540,3510],{"className":3541},[90],[13,3543,3544,3547],{"style":3403},[13,3545],{"className":3546,"style":206},[205],[13,3548,3550,3553,3556,3559,3562,3566,3572,3576,3579,3582,3588,3591,3594,3597,3600,3603,3606,3609,3615,3618,3621,3624,3627,3630,3636,3640,3643],{"className":3549},[90],[13,3551],{"className":3552},[90],[13,3554],{"className":3555,"style":268},[267],[13,3557,566],{"className":3558},[272],[13,3560],{"className":3561,"style":268},[267],[13,3563,3565],{"className":3564},[90],"49",[13,3567,3569],{"className":3568},[90],[13,3570,160],{"className":3571},[311],[13,3573,3575],{"className":3574},[90],"152",[13,3577,3268],{"className":3578},[267],[13,3580,539],{"className":3581},[180],[13,3583,3585],{"className":3584},[90,687],[13,3586,3308],{"className":3587},[90],[13,3589,440],{"className":3590},[263],[13,3592],{"className":3593,"style":351},[267],[13,3595,780],{"className":3596},[355],[13,3598],{"className":3599,"style":351},[267],[13,3601,1230],{"className":3602},[90],[13,3604,3268],{"className":3605},[267],[13,3607,539],{"className":3608},[180],[13,3610,3612],{"className":3611},[90,687],[13,3613,3321],{"className":3614},[90],[13,3616,440],{"className":3617},[263],[13,3619],{"className":3620,"style":268},[267],[13,3622,566],{"className":3623},[272],[13,3625],{"className":3626,"style":268},[267],[13,3628,3565],{"className":3629},[90],[13,3631,3633],{"className":3632},[90],[13,3634,160],{"className":3635},[311],[13,3637,3639],{"className":3638},[90],"184",[13,3641,3268],{"className":3642},[267],[13,3644,3646],{"className":3645},[90,687],[13,3647,3510],{"className":3648},[90],[13,3650,3651,3654],{"style":3426},[13,3652],{"className":3653,"style":206},[205],[13,3655,3657,3660,3663,3666,3669],{"className":3656},[90],[13,3658],{"className":3659},[90],[13,3661],{"className":3662,"style":268},[267],[13,3664,3349],{"className":3665},[272],[13,3667],{"className":3668,"style":268},[267],[13,3670,3672],{"className":3671},[90,687],[13,3673,3352],{"className":3674},[90],[13,3676,250],{"className":3677},[249],[13,3679,3681],{"className":3680},[193],[13,3682,3684],{"className":3683,"style":3442},[197],[13,3685],{},[10,3687,3688],{},"This is not a 1.43B-vertex upload. The renderer sends a compact PaintOp stream backed by SHM:",[3690,3691],"diagram-sequence",{":steps":3692,":summary":3693,"left":460,"right":3694},"[{\"arrow\":\"1) Inline: Payload+Remainder\",\"note\":\"Verb sum += 57,142\"},{\"arrow\":\"2) Upload 3.6 MB Noise Chunk\",\"note\":\"(Saved to PaintCache) Verb sum += 400,000\"},{\"arrow\":\"3) Draw 3,578 Cached Copies (Tiny IPC cache IDs)\",\"note\":\"Verb sum += 1.431B\"}]","[\"Total V = 1.43B\",\"(V - 2) * 3 -> 4,124\"]","GPU (Ganesh)",[10,3696,3697],{},"The noise path uses 200,000 move\u002Fline pairs to inflate the verb accumulator without generating real geometry (zero fan triangles). The actual overflow happens later during the allocation calculation: (V - 2) * 3. Because the geometry is cached, subsequent OOB write triggers only require a small IPC payload.",[10,3699,3700],{},"The 32,992-byte vertex request lands in bucket-57344. Skia's allocator rounds the request to 49,152 bytes (a power-of-two midpoint size), backing it with a GrCpuBuffer. This results in a 49,184-byte allocation, which PartitionAlloc bins to bucket-57344.",[3702,3703],"diagram-nested",{":after":3704,":children":3705,"label":3706,"size":3707},"[\"(8,160 bytes unused tail)\"]","[{\"label\":\"PartitionAlloc allocation\",\"size\":\"49,184 bytes\",\"before\":[\"GrCpuBuffer header (sizeof(GrCpuBuffer))\"],\"children\":[{\"label\":\"GrCpuBuffer staging data\",\"size\":\"49,152 bytes\",\"children\":[{\"label\":\"Wrapped Vertex Data\",\"size\":\"32,992 bytes\"}],\"after\":[\"(16,160 bytes of buffer slack)\"]}]}]","bucket-57344 slot","57,344 bytes",[449,3709,3711],{"id":3710},"the-oob-geometry","The OOB geometry",[10,3713,3714],{},"To trigger the overflow, we decouple the allocated buffer size from the actual write extent by splitting the input path cascade into two distinct phases:",[466,3716,3717,3723],{},[413,3718,3719,3722],{},[37,3720,3721],{},"Inflation (noise path)",": we use a path containing hundreds of thousands of verbs (move\u002Fline pairs) that produce zero triangles during tessellation. These verbs inflate the total verb accumulator (V).",[413,3724,3725,3728],{},[37,3726,3727],{},"Corruption (payload path)",": a hand-crafted path containing real triangles whose (x, y) vertex coordinates represent the exact byte values we want to write.",[10,3730,3731],{},"By placing the payload path at a specific position in the cascade, its OOB writes land on the adjacent victim's SkPathData structure, corrupting its pointers.",[29,3733,3735],{"id":3734},"why-skpath-is-the-victim","Why SkPath is the victim",[10,3737,3738],{},"To turn our OOB write into a useful arbitrary read\u002Fwrite primitive, we must find a \"victim\" data structure to overwrite in memory. We are hunting for a structure that satisfies three requirements:",[466,3740,3741,3747,3753],{},[413,3742,3743,3746],{},[37,3744,3745],{},"Dynamic sizing",": the object must be dynamically sized so we can force it into the same PartitionAlloc bucket as our overflow source.",[413,3748,3749,3752],{},[37,3750,3751],{},"Unified allocation",": the object's pointer-bearing control header must reside in the exact same contiguous allocation as its raw payload. If they are split into separate allocations (like std::vector or SkBitmap), our OOB write will only reach the raw data buffer, leaving the control pointers untouched.",[413,3754,3755,3758],{},[37,3756,3757],{},"Observability",": overwriting the object's pointers must allow us to read arbitrary memory and leak the data back to the renderer (e.g., by having an observable side effect).",[10,3760,3761],{},"SkPath is a strong victim candidate because its underlying storage class, SkPathData, meets all three criteria.",[449,3763,3765],{"id":3764},"constraint-1-bucket-and-span-matching-via-dynamic-sizing","Constraint 1: bucket and span matching via dynamic sizing",[10,3767,3768],{},"The victim needs a large, pointer-bearing allocation in the next single-slot reservation. The source is operator new(49184) in bucket-57344, so the victim is sized into bucket-57344 as well. The groom then controls the order of adjacent 64 KiB slot-span reservations inside the BRP pool.",[10,3770,3771],{},"SkPath has variable-sized internal storage governed by verb and point counts:",[508,3773,3776],{"className":3774,"code":3775,"language":687,"meta":513},[685],"SkPathData storage = header + (npts x 8) + verb\u002Fconic arrays\n",[437,3777,3775],{"__ignoreMap":513},[449,3779,3781],{"id":3780},"constraint-2-contiguous-header-and-payload","Constraint 2: contiguous header and payload",[10,3783,3784],{},"We want to corrupt pointers. Variable size alone is insufficient. Objects like std::vector, SharedImage, or SkBitmap separate their pointer-bearing headers from their bulk data. Our OOB write only reaches the bulk data allocation, leaving the header pointers untouched in a separate bucket.",[10,3786,3787],{},"SkPath's storage allocates both the SkPathData header and the verbs\u002Fpoints arrays in a single contiguous block of memory.",[508,3789,3791],{"className":510,"code":3790,"language":512,"meta":513,"style":513},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FSkPathData.cpp\nsk_sp\u003CSkPathData> SkPathData::Alloc(size_t npts, size_t nvbs, ...) {\n    \u002F\u002F (Accumulator math calculates total = header + pts\n    \u002F\u002F + conics + verbs)\n    void* storage = ::operator new(*size);\n    return sk_sp\u003CSkPathData>(new (storage) SkPathData(...));\n}\n",[437,3792,3793,3798,3838,3843,3848,3876,3902],{"__ignoreMap":513},[13,3794,3795],{"class":518,"line":519},[13,3796,3797],{"class":522},"\u002F\u002F third_party\u002Fskia\u002Fsrc\u002Fcore\u002FSkPathData.cpp\n",[13,3799,3800,3803,3806,3809,3812,3814,3816,3819,3821,3824,3828,3830,3832,3835],{"class":518,"line":526},[13,3801,3802],{"class":529},"sk_sp",[13,3804,3805],{"class":533},"\u003C",[13,3807,3808],{"class":529},"SkPathData",[13,3810,3811],{"class":533},"> ",[13,3813,3808],{"class":529},[13,3815,534],{"class":533},[13,3817,3818],{"class":529},"Alloc",[13,3820,539],{"class":533},[13,3822,3823],{"class":542},"size_t",[13,3825,3827],{"class":3826},"s4XuR"," npts",[13,3829,2263],{"class":533},[13,3831,3823],{"class":542},[13,3833,3834],{"class":3826}," nvbs",[13,3836,3837],{"class":533},", ...) {\n",[13,3839,3840],{"class":518,"line":555},[13,3841,3842],{"class":522},"    \u002F\u002F (Accumulator math calculates total = header + pts\n",[13,3844,3845],{"class":518,"line":576},[13,3846,3847],{"class":522},"    \u002F\u002F + conics + verbs)\n",[13,3849,3850,3853,3856,3858,3861,3864,3867,3869,3871,3874],{"class":518,"line":601},[13,3851,3852],{"class":542},"    void*",[13,3854,3855],{"class":533}," storage ",[13,3857,566],{"class":542},[13,3859,3860],{"class":533}," ::",[13,3862,3863],{"class":542},"operator",[13,3865,3866],{"class":529}," new",[13,3868,539],{"class":533},[13,3870,549],{"class":542},[13,3872,3873],{"class":3826},"size",[13,3875,678],{"class":533},[13,3877,3878,3881,3884,3886,3888,3891,3894,3897,3899],{"class":518,"line":629},[13,3879,3880],{"class":542},"    return",[13,3882,3883],{"class":529}," sk_sp",[13,3885,3805],{"class":533},[13,3887,3808],{"class":529},[13,3889,3890],{"class":533},">(",[13,3892,3893],{"class":542},"new",[13,3895,3896],{"class":533}," (storage) ",[13,3898,3808],{"class":529},[13,3900,3901],{"class":533},"(...));\n",[13,3903,3904],{"class":518,"line":2306},[13,3905,632],{"class":533},[10,3907,3908],{},"The header, containing the fPoints\u002FfVerbs pointers, is fused to the payload.",[449,3910,3912],{"id":3911},"constraint-3-observable-side-effect","Constraint 3: observable side effect",[10,3914,3915],{},"The victim also needs post-corruption observability. The GPU process is almost a one-way data sink: the renderer issues draw commands; the GPU returns rendered pixels and very little else.",[10,3917,3918],{},"SkPath is useful because it gets rendered to pixels. Once we corrupt its fPoints pointer to alias another memory location, asking the GPU to draw the path reads bytes from that memory location, interprets them as floats, transforms them through the canvas matrix, and rasterizes them. The renderer can then call ReadbackARGB and get the pixels.",[3920,3921,3922],"blockquote",{},[10,3923,3924],{},"How do we recover the pointer from pixels though?",[10,3926,3927],{},"But first, we must work out the tedious mechanical details: how to groom the heap so we can reach the victim in the first place.",[29,3929,3931],{"id":3930},"the-forge-primitive-write","The forge primitive (write)",[10,3933,3934],{},"Our goal is to build a write primitive, forge(W, V, AF). A single execution corrupts the victim SkPathData header with three pointers:",[410,3936,3937,3943,3949],{},[413,3938,3939,3942],{},[37,3940,3941],{},"W (fPoints)",": the address from which Skia reads coordinate data when drawing the path.",[413,3944,3945,3948],{},[37,3946,3947],{},"V (fVerbs)",": the address from which Skia reads verbs. We point this to a {Move, Line} sequence so the coordinates are consumed.",[413,3950,3951,3954],{},[37,3952,3953],{},"AF (listener.data)",": the address of a callback list. If the ownership bit is set, evicting the path calls sk_free(AF).",[10,3956,3957],{},"Because the GPU must iterate 1.43 billion verbs to trigger the overflow, each forge takes ~3.5 seconds. The rest of the exploit must therefore be designed to use as few writes as possible.",[449,3959,3961],{"id":3960},"the-heap-spray-groom-pinunpin","The heap-spray groom (\"pin\u002Funpin\")",[10,3963,3964],{},"To corrupt the victim, we must force the allocator to place our overflow buffer immediately before the victim in memory. We achieve this in three steps:",[466,3966,3967,3973,3979],{},[413,3968,3969,3972],{},[37,3970,3971],{},"Pin",": fill empty space, place the victim, and add trailing cushions.",[413,3974,3975,3978],{},[37,3976,3977],{},"Unpin",": free the allocation directly preceding the victim to leave a vacancy.",[413,3980,3981,3984],{},[37,3982,3983],{},"Reclaim",": allocate the overflow buffer in the vacancy and trigger the OOB write.",[10,3986,3987],{},"More concretely:",[2189,3989],{":items":3990,"title":3991},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"TC[95] (The \\\"Pin\\\" slot)\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 1: The Pin",[10,3993,3994],{},"We allocate 96 entries (TC[0..95]) to fill active heap slots. Right after TC[95], we allocate the victim SkPathData. We then allocate 64 cushion entries (TC[96..159]) so the victim does not land next to unmapped memory. This pins the victim directly between TC[95] and TC[96].",[2189,3996],{":items":3997,"title":3998},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"[ EMPTY HOLE ]\",\"note\":\"Target\",\"highlight\":\"empty\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 2: The Unpin",[10,4000,4001],{},"We delete TC[95]. Because this size class allocates one object per page block, freeing TC[95] leaves its slot vacant while keeping the adjacent victim in place.",[2189,4003],{":items":4004,"title":4005},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"[ Overflow Geometry ]\",\"note\":\"cascades down\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"note\":\"Corrupts header!\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 3: Reallocation & Overflow",[10,4007,4008],{},"We trigger the path overflow. Skia requests a vertex buffer of the same size class, which the allocator places in the vacant TC[95] slot. The overflow write cascades directly into the adjacent victim.",[10,4010,4011],{},"Okay, I lied about the three easy-peasy steps for heap grooming. In reality, because the visual read (see the c1read primitive below) requires repeating this groom dozens of times, we need one final step to maintain stability:",[2189,4013],{":items":4014,"title":4015},"[{\"label\":\"TC[94] (Pre-slot padding)\"},{\"label\":\"[ Re-secured Pin Slot ]\",\"note\":\"Repinned\",\"highlight\":\"target\"},{\"label\":\"SkPathData (The \\\"Victim\\\")\",\"highlight\":\"victim\"},{\"label\":\"TC[96] (Cushion landing zone)\"}]","Step 4: The Re-pin",[10,4017,4018],{},"To do this, we delete the pin, trigger the overflow, and create a new pin all in one command batch. The moment the overflow buffer is freed, the new pin re-occupies the slot, preventing other allocations from stealing it before our next write.",[10,4020,4021],{},"Note: these counts of 96 and 64 are engineering choices.",[449,4023,4025],{"id":4024},"the-dual-use-corruption","The dual-use corruption",[10,4027,4028],{},"We want to achieve two distinct goals with our corruption: memory reading (for the walk) and arbitrary freeing (for the hijack).",[466,4030,4031,4037],{},[413,4032,4033,4036],{},[37,4034,4035],{},"The read",": to read memory, we corrupt the points and verbs arrays in SkPathData. We set points = W (the memory address to read) and verbs = V (pointing to a {kMove, kLine} sequence). When Skia draws the path, it reads the bytes at W as float coordinates and draws a line, rendering the memory to pixels.",[413,4038,4039,4042],{},[37,4040,4041],{},"The free",": to free memory, we corrupt the listener array. We set listener.data = AF (the address to free), listener.size = 0, and listener.own = 1. When the path is evicted from the cache, Skia's destructor cleans up the listener array and calls sk_free(listener.data).",[10,4044,4045],{},"Because these fields occupy different offsets within the SkPathData structure, we can do both at the same time:",[508,4047,4050],{"className":4048,"code":4049,"language":687,"meta":513},[685],"SkPathData\n  refcount = 1\n  listener.data = AF   \u003C--- Address to free\n  listener.size = 0\n  listener.own  = 1\n  points        = W    \u003C--- Memory address to read\n  points.count  = 2\n  conics        = 0\n  verbs         = V    \u003C--- Points to {kMove, kLine}\n  verbs.count   = 2\n",[437,4051,4049],{"__ignoreMap":513},[10,4053,4054],{},"A single forge(W, V, AF) can configure both primitives, saving us from performing separate heap grooms.",[10,4056,4057],{},"With the ability to write arbitrary values into the victim's control structure and trigger arbitrary frees, we now need a way to read arbitrary memory so we can inspect the GPU heap.",[29,4059,4061],{"id":4060},"the-c1read-primitive-read","The c1read primitive (read)",[10,4063,4064],{},"To read memory, we must handle the fact that the GPU is a data sink that draws pixels but does not return raw memory. The visual read primitive (c1read) achieves this.",[10,4066,4067],{},"We do not have a direct memory read, but we have:",[410,4069,4070,4073],{},[413,4071,4072],{},"A write (forge) to overwrite the victim's points pointer (fPoints).",[413,4074,4075],{},"An IPC command (ReadbackARGB) to copy rendered pixels back to the renderer.",[10,4077,4078],{},"If we overwrite the victim path's points pointer with the target memory address W, and ask Skia to draw the path, Skia dereferences W, reads the bytes there as coordinate floats, and renders a line. Scanning the resulting pixels reconstructs the original float value, recovering the memory bytes stored at W.",[10,4080,4081],{},"When Skia draws the path, it translates the coordinate values (floats) to actual pixel coordinates on our 640-pixel wide canvas:",[10,4083,4084],{},[13,4085,4087,4125],{"className":4086},[50],[13,4088,4090],{"className":4089},[54],[56,4091,4092],{"xmlns":58},[60,4093,4094,4122],{},[63,4095,4096,4103,4105,4111,4114,4116],{},[782,4097,4098,4101],{},[66,4099,4100],{},"D",[66,4102,68],{},[147,4104,566],{},[782,4106,4107,4109],{},[66,4108,3217],{},[66,4110,68],{},[66,4112,4113],{},"X",[147,4115,780],{},[782,4117,4118,4120],{},[66,4119,17],{},[66,4121,68],{},[70,4123,4124],{"encoding":72},"D_x = S_x X + T_x",[13,4126,4128,4186,4247],{"className":4127,"ariaHidden":77},[76],[13,4129,4131,4134,4177,4180,4183],{"className":4130},[81],[13,4132],{"className":4133,"style":938},[85],[13,4135,4137,4141],{"className":4136},[90],[13,4138,4100],{"className":4139,"style":4140},[90,91],"margin-right:0.0278em;",[13,4142,4144],{"className":4143},[739],[13,4145,4147,4169],{"className":4146},[188,189],[13,4148,4150,4166],{"className":4149},[193],[13,4151,4154],{"className":4152,"style":4153},[197],"height:0.1514em;",[13,4155,4157,4160],{"style":4156},"top:-2.55em;margin-left:-0.0278em;margin-right:0.05em;",[13,4158],{"className":4159,"style":755},[205],[13,4161,4163],{"className":4162},[210,211,212,213],[13,4164,68],{"className":4165},[90,91,213],[13,4167,250],{"className":4168},[249],[13,4170,4172],{"className":4171},[193],[13,4173,4175],{"className":4174,"style":853},[197],[13,4176],{},[13,4178],{"className":4179,"style":268},[267],[13,4181,566],{"className":4182},[272],[13,4184],{"className":4185,"style":268},[267],[13,4187,4189,4192,4234,4238,4241,4244],{"className":4188},[81],[13,4190],{"className":4191,"style":938},[85],[13,4193,4195,4199],{"className":4194},[90],[13,4196,3217],{"className":4197,"style":4198},[90,91],"margin-right:0.0576em;",[13,4200,4202],{"className":4201},[739],[13,4203,4205,4226],{"className":4204},[188,189],[13,4206,4208,4223],{"className":4207},[193],[13,4209,4211],{"className":4210,"style":4153},[197],[13,4212,4214,4217],{"style":4213},"top:-2.55em;margin-left:-0.0576em;margin-right:0.05em;",[13,4215],{"className":4216,"style":755},[205],[13,4218,4220],{"className":4219},[210,211,212,213],[13,4221,68],{"className":4222},[90,91,213],[13,4224,250],{"className":4225},[249],[13,4227,4229],{"className":4228},[193],[13,4230,4232],{"className":4231,"style":853},[197],[13,4233],{},[13,4235,4113],{"className":4236,"style":4237},[90,91],"margin-right:0.0785em;",[13,4239],{"className":4240,"style":351},[267],[13,4242,780],{"className":4243},[355],[13,4245],{"className":4246,"style":351},[267],[13,4248,4250,4253],{"className":4249},[81],[13,4251],{"className":4252,"style":938},[85],[13,4254,4256,4260],{"className":4255},[90],[13,4257,17],{"className":4258,"style":4259},[90,91],"margin-right:0.1389em;",[13,4261,4263],{"className":4262},[739],[13,4264,4266,4287],{"className":4265},[188,189],[13,4267,4269,4284],{"className":4268},[193],[13,4270,4272],{"className":4271,"style":4153},[197],[13,4273,4275,4278],{"style":4274},"top:-2.55em;margin-left:-0.1389em;margin-right:0.05em;",[13,4276],{"className":4277,"style":755},[205],[13,4279,4281],{"className":4280},[210,211,212,213],[13,4282,68],{"className":4283},[90,91,213],[13,4285,250],{"className":4286},[249],[13,4288,4290],{"className":4289},[193],[13,4291,4293],{"className":4292,"style":853},[197],[13,4294],{},[10,4296,4297],{},"If we don't scale the drawing, most arbitrary memory values (read as floats) will be far too large or too small to land on our screen, leaving the line completely invisible. Even if a coordinate does land on our canvas, a single 640-pixel screen can only show us a rough estimate of the value, not the precise 32-bit float.",[10,4299,4300,4301,4371,4372,4442],{},"To find the exact value of the float, we zoom in (scale ",[13,4302,4304,4322],{"className":4303},[50],[13,4305,4307],{"className":4306},[54],[56,4308,4309],{"xmlns":58},[60,4310,4311,4319],{},[63,4312,4313],{},[782,4314,4315,4317],{},[66,4316,3217],{},[66,4318,68],{},[70,4320,4321],{"encoding":72},"S_x",[13,4323,4325],{"className":4324,"ariaHidden":77},[76],[13,4326,4328,4331],{"className":4327},[81],[13,4329],{"className":4330,"style":938},[85],[13,4332,4334,4337],{"className":4333},[90],[13,4335,3217],{"className":4336,"style":4198},[90,91],[13,4338,4340],{"className":4339},[739],[13,4341,4343,4363],{"className":4342},[188,189],[13,4344,4346,4360],{"className":4345},[193],[13,4347,4349],{"className":4348,"style":4153},[197],[13,4350,4351,4354],{"style":4213},[13,4352],{"className":4353,"style":755},[205],[13,4355,4357],{"className":4356},[210,211,212,213],[13,4358,68],{"className":4359},[90,91,213],[13,4361,250],{"className":4362},[249],[13,4364,4366],{"className":4365},[193],[13,4367,4369],{"className":4368,"style":853},[197],[13,4370],{},") and shift the drawing (translate ",[13,4373,4375,4393],{"className":4374},[50],[13,4376,4378],{"className":4377},[54],[56,4379,4380],{"xmlns":58},[60,4381,4382,4390],{},[63,4383,4384],{},[782,4385,4386,4388],{},[66,4387,17],{},[66,4389,68],{},[70,4391,4392],{"encoding":72},"T_x",[13,4394,4396],{"className":4395,"ariaHidden":77},[76],[13,4397,4399,4402],{"className":4398},[81],[13,4400],{"className":4401,"style":938},[85],[13,4403,4405,4408],{"className":4404},[90],[13,4406,17],{"className":4407,"style":4259},[90,91],[13,4409,4411],{"className":4410},[739],[13,4412,4414,4434],{"className":4413},[188,189],[13,4415,4417,4431],{"className":4416},[193],[13,4418,4420],{"className":4419,"style":4153},[197],[13,4421,4422,4425],{"style":4274},[13,4423],{"className":4424,"style":755},[205],[13,4426,4428],{"className":4427},[210,211,212,213],[13,4429,68],{"className":4430},[90,91,213],[13,4432,250],{"className":4433},[249],[13,4435,4437],{"className":4436},[193],[13,4438,4440],{"className":4439,"style":853},[197],[13,4441],{},") over multiple drawing attempts. By progressively magnifying the line and adjusting its position, we can piece together its precise bits. This is our zoom search ladder.",[449,4444,4446],{"id":4445},"the-zoom-search-and-refinement","The zoom search and refinement",[10,4448,4449],{},"To resolve the float X using the zoom search ladder, we first assume a 1-dimensional coordinate space where the screen position is:",[10,4451,4452],{},[13,4453,4455,4490],{"className":4454},[50],[13,4456,4458],{"className":4457},[54],[56,4459,4460],{"xmlns":58},[60,4461,4462,4488],{},[63,4463,4464,4470,4472,4478,4480,4482],{},[782,4465,4466,4468],{},[66,4467,4100],{},[66,4469,68],{},[147,4471,566],{},[782,4473,4474,4476],{},[66,4475,3217],{},[66,4477,68],{},[66,4479,4113],{},[147,4481,780],{},[782,4483,4484,4486],{},[66,4485,17],{},[66,4487,68],{},[70,4489,4124],{"encoding":72},[13,4491,4493,4548,4606],{"className":4492,"ariaHidden":77},[76],[13,4494,4496,4499,4539,4542,4545],{"className":4495},[81],[13,4497],{"className":4498,"style":938},[85],[13,4500,4502,4505],{"className":4501},[90],[13,4503,4100],{"className":4504,"style":4140},[90,91],[13,4506,4508],{"className":4507},[739],[13,4509,4511,4531],{"className":4510},[188,189],[13,4512,4514,4528],{"className":4513},[193],[13,4515,4517],{"className":4516,"style":4153},[197],[13,4518,4519,4522],{"style":4156},[13,4520],{"className":4521,"style":755},[205],[13,4523,4525],{"className":4524},[210,211,212,213],[13,4526,68],{"className":4527},[90,91,213],[13,4529,250],{"className":4530},[249],[13,4532,4534],{"className":4533},[193],[13,4535,4537],{"className":4536,"style":853},[197],[13,4538],{},[13,4540],{"className":4541,"style":268},[267],[13,4543,566],{"className":4544},[272],[13,4546],{"className":4547,"style":268},[267],[13,4549,4551,4554,4594,4597,4600,4603],{"className":4550},[81],[13,4552],{"className":4553,"style":938},[85],[13,4555,4557,4560],{"className":4556},[90],[13,4558,3217],{"className":4559,"style":4198},[90,91],[13,4561,4563],{"className":4562},[739],[13,4564,4566,4586],{"className":4565},[188,189],[13,4567,4569,4583],{"className":4568},[193],[13,4570,4572],{"className":4571,"style":4153},[197],[13,4573,4574,4577],{"style":4213},[13,4575],{"className":4576,"style":755},[205],[13,4578,4580],{"className":4579},[210,211,212,213],[13,4581,68],{"className":4582},[90,91,213],[13,4584,250],{"className":4585},[249],[13,4587,4589],{"className":4588},[193],[13,4590,4592],{"className":4591,"style":853},[197],[13,4593],{},[13,4595,4113],{"className":4596,"style":4237},[90,91],[13,4598],{"className":4599,"style":351},[267],[13,4601,780],{"className":4602},[355],[13,4604],{"className":4605,"style":351},[267],[13,4607,4609,4612],{"className":4608},[81],[13,4610],{"className":4611,"style":938},[85],[13,4613,4615,4618],{"className":4614},[90],[13,4616,17],{"className":4617,"style":4259},[90,91],[13,4619,4621],{"className":4620},[739],[13,4622,4624,4644],{"className":4623},[188,189],[13,4625,4627,4641],{"className":4626},[193],[13,4628,4630],{"className":4629,"style":4153},[197],[13,4631,4632,4635],{"style":4274},[13,4633],{"className":4634,"style":755},[205],[13,4636,4638],{"className":4637},[210,211,212,213],[13,4639,68],{"className":4640},[90,91,213],[13,4642,250],{"className":4643},[249],[13,4645,4647],{"className":4646},[193],[13,4648,4650],{"className":4649,"style":853},[197],[13,4651],{},[10,4653,4654],{},"We must coordinate our probes to handle two main constraints: the low-resolution canvas and the risk of the coordinate mapping off-screen.",[10,4656,4657],{},"Our intuition to solve this 1D problem is structured as follows:",[466,4659,4660,4666,4742,4748],{},[413,4661,4662,4665],{},[37,4663,4664],{},"Low-resolution channel",": a 640-pixel canvas provides only about 9 bits of resolution. We cannot read a 32-bit float directly.",[413,4667,4668,4671,4672,4741],{},[37,4669,4670],{},"Magnification",": we must zoom in (scale up ",[13,4673,4675,4692],{"className":4674},[50],[13,4676,4678],{"className":4677},[54],[56,4679,4680],{"xmlns":58},[60,4681,4682,4690],{},[63,4683,4684],{},[782,4685,4686,4688],{},[66,4687,3217],{},[66,4689,68],{},[70,4691,4321],{"encoding":72},[13,4693,4695],{"className":4694,"ariaHidden":77},[76],[13,4696,4698,4701],{"className":4697},[81],[13,4699],{"className":4700,"style":938},[85],[13,4702,4704,4707],{"className":4703},[90],[13,4705,3217],{"className":4706,"style":4198},[90,91],[13,4708,4710],{"className":4709},[739],[13,4711,4713,4733],{"className":4712},[188,189],[13,4714,4716,4730],{"className":4715},[193],[13,4717,4719],{"className":4718,"style":4153},[197],[13,4720,4721,4724],{"style":4213},[13,4722],{"className":4723,"style":755},[205],[13,4725,4727],{"className":4726},[210,211,212,213],[13,4728,68],{"className":4729},[90,91,213],[13,4731,250],{"className":4732},[249],[13,4734,4736],{"className":4735},[193],[13,4737,4739],{"className":4738,"style":853},[197],[13,4740],{},") to expose the fine details of the float's mantissa.",[413,4743,4744,4747],{},[37,4745,4746],{},"Re-centering",": zooming in pushes the coordinate off-screen unless we center the viewport. We shift the viewport by subtracting our current estimate (est) of the float, drawing the residual error (X − est) scaled up.",[413,4749,4750,4753,4754,4823,4824,4899,4900,5125,5126,5326,5327,92,5401,5560],{},[37,4751,4752],{},"Exact arithmetic",": we choose scale ",[13,4755,4757,4774],{"className":4756},[50],[13,4758,4760],{"className":4759},[54],[56,4761,4762],{"xmlns":58},[60,4763,4764,4772],{},[63,4765,4766],{},[782,4767,4768,4770],{},[66,4769,3217],{},[66,4771,68],{},[70,4773,4321],{"encoding":72},[13,4775,4777],{"className":4776,"ariaHidden":77},[76],[13,4778,4780,4783],{"className":4779},[81],[13,4781],{"className":4782,"style":938},[85],[13,4784,4786,4789],{"className":4785},[90],[13,4787,3217],{"className":4788,"style":4198},[90,91],[13,4790,4792],{"className":4791},[739],[13,4793,4795,4815],{"className":4794},[188,189],[13,4796,4798,4812],{"className":4797},[193],[13,4799,4801],{"className":4800,"style":4153},[197],[13,4802,4803,4806],{"style":4213},[13,4804],{"className":4805,"style":755},[205],[13,4807,4809],{"className":4808},[210,211,212,213],[13,4810,68],{"className":4811},[90,91,213],[13,4813,250],{"className":4814},[249],[13,4816,4818],{"className":4817},[193],[13,4819,4821],{"className":4820,"style":853},[197],[13,4822],{}," to be a power of 2, so multiplying ",[13,4825,4827,4847],{"className":4826},[50],[13,4828,4830],{"className":4829},[54],[56,4831,4832],{"xmlns":58},[60,4833,4834,4844],{},[63,4835,4836,4842],{},[782,4837,4838,4840],{},[66,4839,3217],{},[66,4841,68],{},[66,4843,4113],{},[70,4845,4846],{"encoding":72},"S_x X",[13,4848,4850],{"className":4849,"ariaHidden":77},[76],[13,4851,4853,4856,4896],{"className":4852},[81],[13,4854],{"className":4855,"style":938},[85],[13,4857,4859,4862],{"className":4858},[90],[13,4860,3217],{"className":4861,"style":4198},[90,91],[13,4863,4865],{"className":4864},[739],[13,4866,4868,4888],{"className":4867},[188,189],[13,4869,4871,4885],{"className":4870},[193],[13,4872,4874],{"className":4873,"style":4153},[197],[13,4875,4876,4879],{"style":4213},[13,4877],{"className":4878,"style":755},[205],[13,4880,4882],{"className":4881},[210,211,212,213],[13,4883,68],{"className":4884},[90,91,213],[13,4886,250],{"className":4887},[249],[13,4889,4891],{"className":4890},[193],[13,4892,4894],{"className":4893,"style":853},[197],[13,4895],{},[13,4897,4113],{"className":4898,"style":4237},[90,91]," only shifts the exponent without rounding the mantissa. We precompute ",[13,4901,4903,4942],{"className":4902},[50],[13,4904,4906],{"className":4905},[54],[56,4907,4908],{"xmlns":58},[60,4909,4910,4939],{},[63,4911,4912,4918,4920,4926,4928,4931,4933],{},[782,4913,4914,4916],{},[66,4915,17],{},[66,4917,68],{},[147,4919,566],{},[782,4921,4922,4924],{},[66,4923,1272],{},[143,4925,1016],{},[147,4927,329],{},[785,4929,4930],{},"est",[147,4932,2628],{},[782,4934,4935,4937],{},[66,4936,3217],{},[66,4938,68],{},[70,4940,4941],{"encoding":72},"T_x = c_0 - \\text{est} \\cdot S_x",[13,4943,4945,5000,5057,5079],{"className":4944,"ariaHidden":77},[76],[13,4946,4948,4951,4991,4994,4997],{"className":4947},[81],[13,4949],{"className":4950,"style":938},[85],[13,4952,4954,4957],{"className":4953},[90],[13,4955,17],{"className":4956,"style":4259},[90,91],[13,4958,4960],{"className":4959},[739],[13,4961,4963,4983],{"className":4962},[188,189],[13,4964,4966,4980],{"className":4965},[193],[13,4967,4969],{"className":4968,"style":4153},[197],[13,4970,4971,4974],{"style":4274},[13,4972],{"className":4973,"style":755},[205],[13,4975,4977],{"className":4976},[210,211,212,213],[13,4978,68],{"className":4979},[90,91,213],[13,4981,250],{"className":4982},[249],[13,4984,4986],{"className":4985},[193],[13,4987,4989],{"className":4988,"style":853},[197],[13,4990],{},[13,4992],{"className":4993,"style":268},[267],[13,4995,566],{"className":4996},[272],[13,4998],{"className":4999,"style":268},[267],[13,5001,5003,5007,5048,5051,5054],{"className":5002},[81],[13,5004],{"className":5005,"style":5006},[85],"height:0.7333em;vertical-align:-0.15em;",[13,5008,5010,5013],{"className":5009},[90],[13,5011,1272],{"className":5012},[90,91],[13,5014,5016],{"className":5015},[739],[13,5017,5019,5040],{"className":5018},[188,189],[13,5020,5022,5037],{"className":5021},[193],[13,5023,5025],{"className":5024,"style":828},[197],[13,5026,5028,5031],{"style":5027},"top:-2.55em;margin-left:0em;margin-right:0.05em;",[13,5029],{"className":5030,"style":755},[205],[13,5032,5034],{"className":5033},[210,211,212,213],[13,5035,1016],{"className":5036},[90,213],[13,5038,250],{"className":5039},[249],[13,5041,5043],{"className":5042},[193],[13,5044,5046],{"className":5045,"style":853},[197],[13,5047],{},[13,5049],{"className":5050,"style":351},[267],[13,5052,329],{"className":5053},[355],[13,5055],{"className":5056,"style":351},[267],[13,5058,5060,5064,5070,5073,5076],{"className":5059},[81],[13,5061],{"className":5062,"style":5063},[85],"height:0.6151em;",[13,5065,5067],{"className":5066},[90,687],[13,5068,4930],{"className":5069},[90],[13,5071],{"className":5072,"style":351},[267],[13,5074,2628],{"className":5075},[355],[13,5077],{"className":5078,"style":351},[267],[13,5080,5082,5085],{"className":5081},[81],[13,5083],{"className":5084,"style":938},[85],[13,5086,5088,5091],{"className":5087},[90],[13,5089,3217],{"className":5090,"style":4198},[90,91],[13,5092,5094],{"className":5093},[739],[13,5095,5097,5117],{"className":5096},[188,189],[13,5098,5100,5114],{"className":5099},[193],[13,5101,5103],{"className":5102,"style":4153},[197],[13,5104,5105,5108],{"style":4213},[13,5106],{"className":5107,"style":755},[205],[13,5109,5111],{"className":5110},[210,211,212,213],[13,5112,68],{"className":5113},[90,91,213],[13,5115,250],{"className":5116},[249],[13,5118,5120],{"className":5119},[193],[13,5121,5123],{"className":5122,"style":853},[197],[13,5124],{}," in JavaScript. When the GPU calculates ",[13,5127,5129,5164],{"className":5128},[50],[13,5130,5132],{"className":5131},[54],[56,5133,5134],{"xmlns":58},[60,5135,5136,5162],{},[63,5137,5138,5144,5146,5152,5154,5156],{},[782,5139,5140,5142],{},[66,5141,4100],{},[66,5143,68],{},[147,5145,566],{},[782,5147,5148,5150],{},[66,5149,3217],{},[66,5151,68],{},[66,5153,4113],{},[147,5155,780],{},[782,5157,5158,5160],{},[66,5159,17],{},[66,5161,68],{},[70,5163,4124],{"encoding":72},[13,5165,5167,5222,5280],{"className":5166,"ariaHidden":77},[76],[13,5168,5170,5173,5213,5216,5219],{"className":5169},[81],[13,5171],{"className":5172,"style":938},[85],[13,5174,5176,5179],{"className":5175},[90],[13,5177,4100],{"className":5178,"style":4140},[90,91],[13,5180,5182],{"className":5181},[739],[13,5183,5185,5205],{"className":5184},[188,189],[13,5186,5188,5202],{"className":5187},[193],[13,5189,5191],{"className":5190,"style":4153},[197],[13,5192,5193,5196],{"style":4156},[13,5194],{"className":5195,"style":755},[205],[13,5197,5199],{"className":5198},[210,211,212,213],[13,5200,68],{"className":5201},[90,91,213],[13,5203,250],{"className":5204},[249],[13,5206,5208],{"className":5207},[193],[13,5209,5211],{"className":5210,"style":853},[197],[13,5212],{},[13,5214],{"className":5215,"style":268},[267],[13,5217,566],{"className":5218},[272],[13,5220],{"className":5221,"style":268},[267],[13,5223,5225,5228,5268,5271,5274,5277],{"className":5224},[81],[13,5226],{"className":5227,"style":938},[85],[13,5229,5231,5234],{"className":5230},[90],[13,5232,3217],{"className":5233,"style":4198},[90,91],[13,5235,5237],{"className":5236},[739],[13,5238,5240,5260],{"className":5239},[188,189],[13,5241,5243,5257],{"className":5242},[193],[13,5244,5246],{"className":5245,"style":4153},[197],[13,5247,5248,5251],{"style":4213},[13,5249],{"className":5250,"style":755},[205],[13,5252,5254],{"className":5253},[210,211,212,213],[13,5255,68],{"className":5256},[90,91,213],[13,5258,250],{"className":5259},[249],[13,5261,5263],{"className":5262},[193],[13,5264,5266],{"className":5265,"style":853},[197],[13,5267],{},[13,5269,4113],{"className":5270,"style":4237},[90,91],[13,5272],{"className":5273,"style":351},[267],[13,5275,780],{"className":5276},[355],[13,5278],{"className":5279,"style":351},[267],[13,5281,5283,5286],{"className":5282},[81],[13,5284],{"className":5285,"style":938},[85],[13,5287,5289,5292],{"className":5288},[90],[13,5290,17],{"className":5291,"style":4259},[90,91],[13,5293,5295],{"className":5294},[739],[13,5296,5298,5318],{"className":5297},[188,189],[13,5299,5301,5315],{"className":5300},[193],[13,5302,5304],{"className":5303,"style":4153},[197],[13,5305,5306,5309],{"style":4274},[13,5307],{"className":5308,"style":755},[205],[13,5310,5312],{"className":5311},[210,211,212,213],[13,5313,68],{"className":5314},[90,91,213],[13,5316,250],{"className":5317},[249],[13,5319,5321],{"className":5320},[193],[13,5322,5324],{"className":5323,"style":853},[197],[13,5325],{},", the addition behaves as a subtraction between two values of similar magnitude (",[13,5328,5330,5349],{"className":5329},[50],[13,5331,5333],{"className":5332},[54],[56,5334,5335],{"xmlns":58},[60,5336,5337,5347],{},[63,5338,5339,5345],{},[782,5340,5341,5343],{},[66,5342,3217],{},[66,5344,68],{},[66,5346,4113],{},[70,5348,4846],{"encoding":72},[13,5350,5352],{"className":5351,"ariaHidden":77},[76],[13,5353,5355,5358,5398],{"className":5354},[81],[13,5356],{"className":5357,"style":938},[85],[13,5359,5361,5364],{"className":5360},[90],[13,5362,3217],{"className":5363,"style":4198},[90,91],[13,5365,5367],{"className":5366},[739],[13,5368,5370,5390],{"className":5369},[188,189],[13,5371,5373,5387],{"className":5372},[193],[13,5374,5376],{"className":5375,"style":4153},[197],[13,5377,5378,5381],{"style":4213},[13,5379],{"className":5380,"style":755},[205],[13,5382,5384],{"className":5383},[210,211,212,213],[13,5385,68],{"className":5386},[90,91,213],[13,5388,250],{"className":5389},[249],[13,5391,5393],{"className":5392},[193],[13,5394,5396],{"className":5395,"style":853},[197],[13,5397],{},[13,5399,4113],{"className":5400,"style":4237},[90,91],[13,5402,5404,5434],{"className":5403},[50],[13,5405,5407],{"className":5406},[54],[56,5408,5409],{"xmlns":58},[60,5410,5411,5431],{},[63,5412,5413,5415,5417,5423,5425],{},[785,5414,4930],{},[147,5416,2628],{},[782,5418,5419,5421],{},[66,5420,3217],{},[66,5422,68],{},[147,5424,329],{},[782,5426,5427,5429],{},[66,5428,1272],{},[143,5430,1016],{},[70,5432,5433],{"encoding":72},"\\text{est} \\cdot S_x - c_0",[13,5435,5437,5458,5513],{"className":5436,"ariaHidden":77},[76],[13,5438,5440,5443,5449,5452,5455],{"className":5439},[81],[13,5441],{"className":5442,"style":5063},[85],[13,5444,5446],{"className":5445},[90,687],[13,5447,4930],{"className":5448},[90],[13,5450],{"className":5451,"style":351},[267],[13,5453,2628],{"className":5454},[355],[13,5456],{"className":5457,"style":351},[267],[13,5459,5461,5464,5504,5507,5510],{"className":5460},[81],[13,5462],{"className":5463,"style":938},[85],[13,5465,5467,5470],{"className":5466},[90],[13,5468,3217],{"className":5469,"style":4198},[90,91],[13,5471,5473],{"className":5472},[739],[13,5474,5476,5496],{"className":5475},[188,189],[13,5477,5479,5493],{"className":5478},[193],[13,5480,5482],{"className":5481,"style":4153},[197],[13,5483,5484,5487],{"style":4213},[13,5485],{"className":5486,"style":755},[205],[13,5488,5490],{"className":5489},[210,211,212,213],[13,5491,68],{"className":5492},[90,91,213],[13,5494,250],{"className":5495},[249],[13,5497,5499],{"className":5498},[193],[13,5500,5502],{"className":5501,"style":853},[197],[13,5503],{},[13,5505],{"className":5506,"style":351},[267],[13,5508,329],{"className":5509},[355],[13,5511],{"className":5512,"style":351},[267],[13,5514,5516,5520],{"className":5515},[81],[13,5517],{"className":5518,"style":5519},[85],"height:0.5806em;vertical-align:-0.15em;",[13,5521,5523,5526],{"className":5522},[90],[13,5524,1272],{"className":5525},[90,91],[13,5527,5529],{"className":5528},[739],[13,5530,5532,5552],{"className":5531},[188,189],[13,5533,5535,5549],{"className":5534},[193],[13,5536,5538],{"className":5537,"style":828},[197],[13,5539,5540,5543],{"style":5027},[13,5541],{"className":5542,"style":755},[205],[13,5544,5546],{"className":5545},[210,211,212,213],[13,5547,1016],{"className":5548},[90,213],[13,5550,250],{"className":5551},[249],[13,5553,5555],{"className":5554},[193],[13,5556,5558],{"className":5557,"style":853},[197],[13,5559],{},"). Under IEEE-754 rules, this subtraction is exact (Sterbenz's Lemma), ensuring no mantissa bits are lost to rounding.",[10,5562,5563],{},"This is implemented in two phases:",[466,5565,5566,5740],{},[413,5567,5568,5571,5572,5710,5711,5739],{},[37,5569,5570],{},"Coarse search (find exponent)",": we binary search the scale ",[13,5573,5575,5608],{"className":5574},[50],[13,5576,5578],{"className":5577},[54],[56,5579,5580],{"xmlns":58},[60,5581,5582,5605],{},[63,5583,5584,5590,5592],{},[782,5585,5586,5588],{},[66,5587,3217],{},[66,5589,68],{},[147,5591,566],{},[710,5593,5594,5596],{},[143,5595,145],{},[63,5597,5598,5601,5603],{},[143,5599,5600],{},"135",[147,5602,329],{},[66,5604,887],{},[70,5606,5607],{"encoding":72},"S_x = 2^{135-e}",[13,5609,5611,5666],{"className":5610,"ariaHidden":77},[76],[13,5612,5614,5617,5657,5660,5663],{"className":5613},[81],[13,5615],{"className":5616,"style":938},[85],[13,5618,5620,5623],{"className":5619},[90],[13,5621,3217],{"className":5622,"style":4198},[90,91],[13,5624,5626],{"className":5625},[739],[13,5627,5629,5649],{"className":5628},[188,189],[13,5630,5632,5646],{"className":5631},[193],[13,5633,5635],{"className":5634,"style":4153},[197],[13,5636,5637,5640],{"style":4213},[13,5638],{"className":5639,"style":755},[205],[13,5641,5643],{"className":5642},[210,211,212,213],[13,5644,68],{"className":5645},[90,91,213],[13,5647,250],{"className":5648},[249],[13,5650,5652],{"className":5651},[193],[13,5653,5655],{"className":5654,"style":853},[197],[13,5656],{},[13,5658],{"className":5659,"style":268},[267],[13,5661,566],{"className":5662},[272],[13,5664],{"className":5665,"style":268},[267],[13,5667,5669,5672],{"className":5668},[81],[13,5670],{"className":5671,"style":729},[85],[13,5673,5675,5678],{"className":5674},[90],[13,5676,145],{"className":5677},[90],[13,5679,5681],{"className":5680},[739],[13,5682,5684],{"className":5683},[188],[13,5685,5687],{"className":5686},[193],[13,5688,5690],{"className":5689,"style":729},[197],[13,5691,5692,5695],{"style":751},[13,5693],{"className":5694,"style":755},[205],[13,5696,5698],{"className":5697},[210,211,212,213],[13,5699,5701,5704,5707],{"className":5700},[90,213],[13,5702,5600],{"className":5703},[90,213],[13,5705,329],{"className":5706},[355,213],[13,5708,887],{"className":5709},[90,91,213]," until the line's edge lands on the canvas. A dark-pixel bounding box tells us if the line is off-screen (all white), overflowing (clamped), or on-screen (interior). This gives us the float's exponent ",[13,5712,5714,5727],{"className":5713},[50],[13,5715,5717],{"className":5716},[54],[56,5718,5719],{"xmlns":58},[60,5720,5721,5725],{},[63,5722,5723],{},[66,5724,887],{},[70,5726,887],{"encoding":72},[13,5728,5730],{"className":5729,"ariaHidden":77},[76],[13,5731,5733,5736],{"className":5732},[81],[13,5734],{"className":5735,"style":86},[85],[13,5737,887],{"className":5738},[90,91],".",[413,5741,5742,5745,5746,5815,5816,5885],{},[37,5743,5744],{},"Fine refinement (find mantissa)",": we zoom in further by increasing ",[13,5747,5749,5766],{"className":5748},[50],[13,5750,5752],{"className":5751},[54],[56,5753,5754],{"xmlns":58},[60,5755,5756,5764],{},[63,5757,5758],{},[782,5759,5760,5762],{},[66,5761,3217],{},[66,5763,68],{},[70,5765,4321],{"encoding":72},[13,5767,5769],{"className":5768,"ariaHidden":77},[76],[13,5770,5772,5775],{"className":5771},[81],[13,5773],{"className":5774,"style":938},[85],[13,5776,5778,5781],{"className":5777},[90],[13,5779,3217],{"className":5780,"style":4198},[90,91],[13,5782,5784],{"className":5783},[739],[13,5785,5787,5807],{"className":5786},[188,189],[13,5788,5790,5804],{"className":5789},[193],[13,5791,5793],{"className":5792,"style":4153},[197],[13,5794,5795,5798],{"style":4213},[13,5796],{"className":5797,"style":755},[205],[13,5799,5801],{"className":5800},[210,211,212,213],[13,5802,68],{"className":5803},[90,91,213],[13,5805,250],{"className":5806},[249],[13,5808,5810],{"className":5809},[193],[13,5811,5813],{"className":5812,"style":853},[197],[13,5814],{},", translating the viewport by ",[13,5817,5819,5836],{"className":5818},[50],[13,5820,5822],{"className":5821},[54],[56,5823,5824],{"xmlns":58},[60,5825,5826,5834],{},[63,5827,5828],{},[782,5829,5830,5832],{},[66,5831,17],{},[66,5833,68],{},[70,5835,4392],{"encoding":72},[13,5837,5839],{"className":5838,"ariaHidden":77},[76],[13,5840,5842,5845],{"className":5841},[81],[13,5843],{"className":5844,"style":938},[85],[13,5846,5848,5851],{"className":5847},[90],[13,5849,17],{"className":5850,"style":4259},[90,91],[13,5852,5854],{"className":5853},[739],[13,5855,5857,5877],{"className":5856},[188,189],[13,5858,5860,5874],{"className":5859},[193],[13,5861,5863],{"className":5862,"style":4153},[197],[13,5864,5865,5868],{"style":4274},[13,5866],{"className":5867,"style":755},[205],[13,5869,5871],{"className":5870},[210,211,212,213],[13,5872,68],{"className":5873},[90,91,213],[13,5875,250],{"className":5876},[249],[13,5878,5880],{"className":5879},[193],[13,5881,5883],{"className":5882,"style":853},[197],[13,5884],{}," to keep the target edge on canvas as it resolves progressively finer mantissa bits.",[10,5887,5888,5889,5958],{},"To keep the edge on canvas, we translate the viewport by adjusting ",[13,5890,5892,5909],{"className":5891},[50],[13,5893,5895],{"className":5894},[54],[56,5896,5897],{"xmlns":58},[60,5898,5899,5907],{},[63,5900,5901],{},[782,5902,5903,5905],{},[66,5904,17],{},[66,5906,68],{},[70,5908,4392],{"encoding":72},[13,5910,5912],{"className":5911,"ariaHidden":77},[76],[13,5913,5915,5918],{"className":5914},[81],[13,5916],{"className":5917,"style":938},[85],[13,5919,5921,5924],{"className":5920},[90],[13,5922,17],{"className":5923,"style":4259},[90,91],[13,5925,5927],{"className":5926},[739],[13,5928,5930,5950],{"className":5929},[188,189],[13,5931,5933,5947],{"className":5932},[193],[13,5934,5936],{"className":5935,"style":4153},[197],[13,5937,5938,5941],{"style":4274},[13,5939],{"className":5940,"style":755},[205],[13,5942,5944],{"className":5943},[210,211,212,213],[13,5945,68],{"className":5946},[90,91,213],[13,5948,250],{"className":5949},[249],[13,5951,5953],{"className":5952},[193],[13,5954,5956],{"className":5955,"style":853},[197],[13,5957],{}," using our current estimate:",[10,5960,5961],{},[13,5962,5964,6023],{"className":5963},[50],[13,5965,5967],{"className":5966},[54],[56,5968,5969],{"xmlns":58},[60,5970,5971,6020],{},[63,5972,5973,5979,5981,5987,5989,5991,5993,5999,6002,6004,6010,6012,6015,6018],{},[782,5974,5975,5977],{},[66,5976,17],{},[66,5978,68],{},[147,5980,566],{},[782,5982,5983,5985],{},[66,5984,1272],{},[143,5986,1016],{},[147,5988,329],{},[785,5990,4930],{},[147,5992,2628],{},[782,5994,5995,5997],{},[66,5996,3217],{},[66,5998,68],{},[267,6000],{"width":6001},"2em",[147,6003,539],{"stretchy":1079},[782,6005,6006,6008],{},[66,6007,1272],{},[143,6009,1016],{},[147,6011,566],{},[143,6013,6014],{},"320",[785,6016,6017],{}," is the canvas center",[147,6019,440],{"stretchy":1079},[70,6021,6022],{"encoding":72},"T_x = c_0 - \\text{est} \\cdot S_x \\qquad (c_0 = 320 \\text{ is the canvas center})",[13,6024,6026,6081,6136,6157,6260],{"className":6025,"ariaHidden":77},[76],[13,6027,6029,6032,6072,6075,6078],{"className":6028},[81],[13,6030],{"className":6031,"style":938},[85],[13,6033,6035,6038],{"className":6034},[90],[13,6036,17],{"className":6037,"style":4259},[90,91],[13,6039,6041],{"className":6040},[739],[13,6042,6044,6064],{"className":6043},[188,189],[13,6045,6047,6061],{"className":6046},[193],[13,6048,6050],{"className":6049,"style":4153},[197],[13,6051,6052,6055],{"style":4274},[13,6053],{"className":6054,"style":755},[205],[13,6056,6058],{"className":6057},[210,211,212,213],[13,6059,68],{"className":6060},[90,91,213],[13,6062,250],{"className":6063},[249],[13,6065,6067],{"className":6066},[193],[13,6068,6070],{"className":6069,"style":853},[197],[13,6071],{},[13,6073],{"className":6074,"style":268},[267],[13,6076,566],{"className":6077},[272],[13,6079],{"className":6080,"style":268},[267],[13,6082,6084,6087,6127,6130,6133],{"className":6083},[81],[13,6085],{"className":6086,"style":5006},[85],[13,6088,6090,6093],{"className":6089},[90],[13,6091,1272],{"className":6092},[90,91],[13,6094,6096],{"className":6095},[739],[13,6097,6099,6119],{"className":6098},[188,189],[13,6100,6102,6116],{"className":6101},[193],[13,6103,6105],{"className":6104,"style":828},[197],[13,6106,6107,6110],{"style":5027},[13,6108],{"className":6109,"style":755},[205],[13,6111,6113],{"className":6112},[210,211,212,213],[13,6114,1016],{"className":6115},[90,213],[13,6117,250],{"className":6118},[249],[13,6120,6122],{"className":6121},[193],[13,6123,6125],{"className":6124,"style":853},[197],[13,6126],{},[13,6128],{"className":6129,"style":351},[267],[13,6131,329],{"className":6132},[355],[13,6134],{"className":6135,"style":351},[267],[13,6137,6139,6142,6148,6151,6154],{"className":6138},[81],[13,6140],{"className":6141,"style":5063},[85],[13,6143,6145],{"className":6144},[90,687],[13,6146,4930],{"className":6147},[90],[13,6149],{"className":6150,"style":351},[267],[13,6152,2628],{"className":6153},[355],[13,6155],{"className":6156,"style":351},[267],[13,6158,6160,6164,6204,6208,6211,6251,6254,6257],{"className":6159},[81],[13,6161],{"className":6162,"style":6163},[85],"height:1em;vertical-align:-0.25em;",[13,6165,6167,6170],{"className":6166},[90],[13,6168,3217],{"className":6169,"style":4198},[90,91],[13,6171,6173],{"className":6172},[739],[13,6174,6176,6196],{"className":6175},[188,189],[13,6177,6179,6193],{"className":6178},[193],[13,6180,6182],{"className":6181,"style":4153},[197],[13,6183,6184,6187],{"style":4213},[13,6185],{"className":6186,"style":755},[205],[13,6188,6190],{"className":6189},[210,211,212,213],[13,6191,68],{"className":6192},[90,91,213],[13,6194,250],{"className":6195},[249],[13,6197,6199],{"className":6198},[193],[13,6200,6202],{"className":6201,"style":853},[197],[13,6203],{},[13,6205],{"className":6206,"style":6207},[267],"margin-right:2em;",[13,6209,539],{"className":6210},[180],[13,6212,6214,6217],{"className":6213},[90],[13,6215,1272],{"className":6216},[90,91],[13,6218,6220],{"className":6219},[739],[13,6221,6223,6243],{"className":6222},[188,189],[13,6224,6226,6240],{"className":6225},[193],[13,6227,6229],{"className":6228,"style":828},[197],[13,6230,6231,6234],{"style":5027},[13,6232],{"className":6233,"style":755},[205],[13,6235,6237],{"className":6236},[210,211,212,213],[13,6238,1016],{"className":6239},[90,213],[13,6241,250],{"className":6242},[249],[13,6244,6246],{"className":6245},[193],[13,6247,6249],{"className":6248,"style":853},[197],[13,6250],{},[13,6252],{"className":6253,"style":268},[267],[13,6255,566],{"className":6256},[272],[13,6258],{"className":6259,"style":268},[267],[13,6261,6263,6266,6269,6275],{"className":6262},[81],[13,6264],{"className":6265,"style":6163},[85],[13,6267,6014],{"className":6268},[90],[13,6270,6272],{"className":6271},[90,687],[13,6273,6017],{"className":6274},[90],[13,6276,440],{"className":6277},[263],[10,6279,6280],{},"This makes the drawn position:",[10,6282,6283],{},[13,6284,6286,6330],{"className":6285},[50],[13,6287,6289],{"className":6288},[54],[56,6290,6291],{"xmlns":58},[60,6292,6293,6327],{},[63,6294,6295,6301,6303,6309,6311,6313,6315,6317,6319,6321],{},[782,6296,6297,6299],{},[66,6298,4100],{},[66,6300,68],{},[147,6302,566],{},[782,6304,6305,6307],{},[66,6306,3217],{},[66,6308,68],{},[147,6310,539],{"stretchy":1079},[66,6312,4113],{},[147,6314,329],{},[785,6316,4930],{},[147,6318,440],{"stretchy":1079},[147,6320,780],{},[782,6322,6323,6325],{},[66,6324,1272],{},[143,6326,1016],{},[70,6328,6329],{"encoding":72},"D_x = S_x (X - \\text{est}) + c_0",[13,6331,6333,6388,6449,6473],{"className":6332,"ariaHidden":77},[76],[13,6334,6336,6339,6379,6382,6385],{"className":6335},[81],[13,6337],{"className":6338,"style":938},[85],[13,6340,6342,6345],{"className":6341},[90],[13,6343,4100],{"className":6344,"style":4140},[90,91],[13,6346,6348],{"className":6347},[739],[13,6349,6351,6371],{"className":6350},[188,189],[13,6352,6354,6368],{"className":6353},[193],[13,6355,6357],{"className":6356,"style":4153},[197],[13,6358,6359,6362],{"style":4156},[13,6360],{"className":6361,"style":755},[205],[13,6363,6365],{"className":6364},[210,211,212,213],[13,6366,68],{"className":6367},[90,91,213],[13,6369,250],{"className":6370},[249],[13,6372,6374],{"className":6373},[193],[13,6375,6377],{"className":6376,"style":853},[197],[13,6378],{},[13,6380],{"className":6381,"style":268},[267],[13,6383,566],{"className":6384},[272],[13,6386],{"className":6387,"style":268},[267],[13,6389,6391,6394,6434,6437,6440,6443,6446],{"className":6390},[81],[13,6392],{"className":6393,"style":6163},[85],[13,6395,6397,6400],{"className":6396},[90],[13,6398,3217],{"className":6399,"style":4198},[90,91],[13,6401,6403],{"className":6402},[739],[13,6404,6406,6426],{"className":6405},[188,189],[13,6407,6409,6423],{"className":6408},[193],[13,6410,6412],{"className":6411,"style":4153},[197],[13,6413,6414,6417],{"style":4213},[13,6415],{"className":6416,"style":755},[205],[13,6418,6420],{"className":6419},[210,211,212,213],[13,6421,68],{"className":6422},[90,91,213],[13,6424,250],{"className":6425},[249],[13,6427,6429],{"className":6428},[193],[13,6430,6432],{"className":6431,"style":853},[197],[13,6433],{},[13,6435,539],{"className":6436},[180],[13,6438,4113],{"className":6439,"style":4237},[90,91],[13,6441],{"className":6442,"style":351},[267],[13,6444,329],{"className":6445},[355],[13,6447],{"className":6448,"style":351},[267],[13,6450,6452,6455,6461,6464,6467,6470],{"className":6451},[81],[13,6453],{"className":6454,"style":6163},[85],[13,6456,6458],{"className":6457},[90,687],[13,6459,4930],{"className":6460},[90],[13,6462,440],{"className":6463},[263],[13,6465],{"className":6466,"style":351},[267],[13,6468,780],{"className":6469},[355],[13,6471],{"className":6472,"style":351},[267],[13,6474,6476,6479],{"className":6475},[81],[13,6477],{"className":6478,"style":5519},[85],[13,6480,6482,6485],{"className":6481},[90],[13,6483,1272],{"className":6484},[90,91],[13,6486,6488],{"className":6487},[739],[13,6489,6491,6511],{"className":6490},[188,189],[13,6492,6494,6508],{"className":6493},[193],[13,6495,6497],{"className":6496,"style":828},[197],[13,6498,6499,6502],{"style":5027},[13,6500],{"className":6501,"style":755},[205],[13,6503,6505],{"className":6504},[210,211,212,213],[13,6506,1016],{"className":6507},[90,213],[13,6509,250],{"className":6510},[249],[13,6512,6514],{"className":6513},[193],[13,6515,6517],{"className":6516,"style":853},[197],[13,6518],{},[10,6520,6521,6522,6591,6592,6659,6660,6734,6735,6764,6765,6860,6861,6935,6936,7147,7148,7217,7218,7246],{},"Why is this math exact? First, ",[13,6523,6525,6542],{"className":6524},[50],[13,6526,6528],{"className":6527},[54],[56,6529,6530],{"xmlns":58},[60,6531,6532,6540],{},[63,6533,6534],{},[782,6535,6536,6538],{},[66,6537,3217],{},[66,6539,68],{},[70,6541,4321],{"encoding":72},[13,6543,6545],{"className":6544,"ariaHidden":77},[76],[13,6546,6548,6551],{"className":6547},[81],[13,6549],{"className":6550,"style":938},[85],[13,6552,6554,6557],{"className":6553},[90],[13,6555,3217],{"className":6556,"style":4198},[90,91],[13,6558,6560],{"className":6559},[739],[13,6561,6563,6583],{"className":6562},[188,189],[13,6564,6566,6580],{"className":6565},[193],[13,6567,6569],{"className":6568,"style":4153},[197],[13,6570,6571,6574],{"style":4213},[13,6572],{"className":6573,"style":755},[205],[13,6575,6577],{"className":6576},[210,211,212,213],[13,6578,68],{"className":6579},[90,91,213],[13,6581,250],{"className":6582},[249],[13,6584,6586],{"className":6585},[193],[13,6587,6589],{"className":6588,"style":853},[197],[13,6590],{}," is always a power of 2 (e.g. ",[13,6593,6595,6614],{"className":6594},[50],[13,6596,6598],{"className":6597},[54],[56,6599,6600],{"xmlns":58},[60,6601,6602,6611],{},[63,6603,6604],{},[710,6605,6606,6608],{},[143,6607,145],{},[785,6609,6610],{},"exp",[70,6612,6613],{"encoding":72},"2^{\\text{exp}}",[13,6615,6617],{"className":6616,"ariaHidden":77},[76],[13,6618,6620,6624],{"className":6619},[81],[13,6621],{"className":6622,"style":6623},[85],"height:0.6644em;",[13,6625,6627,6630],{"className":6626},[90],[13,6628,145],{"className":6629},[90],[13,6631,6633],{"className":6632},[739],[13,6634,6636],{"className":6635},[188],[13,6637,6639],{"className":6638},[193],[13,6640,6642],{"className":6641,"style":6623},[197],[13,6643,6644,6647],{"style":751},[13,6645],{"className":6646,"style":755},[205],[13,6648,6650],{"className":6649},[210,211,212,213],[13,6651,6653],{"className":6652},[90,213],[13,6654,6656],{"className":6655},[90,687,213],[13,6657,6610],{"className":6658},[90,213],"), meaning the product ",[13,6661,6663,6682],{"className":6662},[50],[13,6664,6666],{"className":6665},[54],[56,6667,6668],{"xmlns":58},[60,6669,6670,6680],{},[63,6671,6672,6678],{},[782,6673,6674,6676],{},[66,6675,3217],{},[66,6677,68],{},[66,6679,4113],{},[70,6681,4846],{"encoding":72},[13,6683,6685],{"className":6684,"ariaHidden":77},[76],[13,6686,6688,6691,6731],{"className":6687},[81],[13,6689],{"className":6690,"style":938},[85],[13,6692,6694,6697],{"className":6693},[90],[13,6695,3217],{"className":6696,"style":4198},[90,91],[13,6698,6700],{"className":6699},[739],[13,6701,6703,6723],{"className":6702},[188,189],[13,6704,6706,6720],{"className":6705},[193],[13,6707,6709],{"className":6708,"style":4153},[197],[13,6710,6711,6714],{"style":4213},[13,6712],{"className":6713,"style":755},[205],[13,6715,6717],{"className":6716},[210,211,212,213],[13,6718,68],{"className":6719},[90,91,213],[13,6721,250],{"className":6722},[249],[13,6724,6726],{"className":6725},[193],[13,6727,6729],{"className":6728,"style":853},[197],[13,6730],{},[13,6732,4113],{"className":6733,"style":4237},[90,91]," incurs no rounding error — it merely shifts the float's exponent. Second, because our estimate (est) is close to ",[13,6736,6738,6751],{"className":6737},[50],[13,6739,6741],{"className":6740},[54],[56,6742,6743],{"xmlns":58},[60,6744,6745,6749],{},[63,6746,6747],{},[66,6748,4113],{},[70,6750,4113],{"encoding":72},[13,6752,6754],{"className":6753,"ariaHidden":77},[76],[13,6755,6757,6761],{"className":6756},[81],[13,6758],{"className":6759,"style":6760},[85],"height:0.6833em;",[13,6762,4113],{"className":6763,"style":4237},[90,91],", the term ",[13,6766,6768,6790],{"className":6767},[50],[13,6769,6771],{"className":6770},[54],[56,6772,6773],{"xmlns":58},[60,6774,6775,6787],{},[63,6776,6777,6779,6781],{},[785,6778,4930],{},[147,6780,2628],{},[782,6782,6783,6785],{},[66,6784,3217],{},[66,6786,68],{},[70,6788,6789],{"encoding":72},"\\text{est} \\cdot S_x",[13,6791,6793,6814],{"className":6792,"ariaHidden":77},[76],[13,6794,6796,6799,6805,6808,6811],{"className":6795},[81],[13,6797],{"className":6798,"style":5063},[85],[13,6800,6802],{"className":6801},[90,687],[13,6803,4930],{"className":6804},[90],[13,6806],{"className":6807,"style":351},[267],[13,6809,2628],{"className":6810},[355],[13,6812],{"className":6813,"style":351},[267],[13,6815,6817,6820],{"className":6816},[81],[13,6818],{"className":6819,"style":938},[85],[13,6821,6823,6826],{"className":6822},[90],[13,6824,3217],{"className":6825,"style":4198},[90,91],[13,6827,6829],{"className":6828},[739],[13,6830,6832,6852],{"className":6831},[188,189],[13,6833,6835,6849],{"className":6834},[193],[13,6836,6838],{"className":6837,"style":4153},[197],[13,6839,6840,6843],{"style":4213},[13,6841],{"className":6842,"style":755},[205],[13,6844,6846],{"className":6845},[210,211,212,213],[13,6847,68],{"className":6848},[90,91,213],[13,6850,250],{"className":6851},[249],[13,6853,6855],{"className":6854},[193],[13,6856,6858],{"className":6857,"style":853},[197],[13,6859],{}," has the same sign and similar magnitude to ",[13,6862,6864,6883],{"className":6863},[50],[13,6865,6867],{"className":6866},[54],[56,6868,6869],{"xmlns":58},[60,6870,6871,6881],{},[63,6872,6873,6879],{},[782,6874,6875,6877],{},[66,6876,3217],{},[66,6878,68],{},[66,6880,4113],{},[70,6882,4846],{"encoding":72},[13,6884,6886],{"className":6885,"ariaHidden":77},[76],[13,6887,6889,6892,6932],{"className":6888},[81],[13,6890],{"className":6891,"style":938},[85],[13,6893,6895,6898],{"className":6894},[90],[13,6896,3217],{"className":6897,"style":4198},[90,91],[13,6899,6901],{"className":6900},[739],[13,6902,6904,6924],{"className":6903},[188,189],[13,6905,6907,6921],{"className":6906},[193],[13,6908,6910],{"className":6909,"style":4153},[197],[13,6911,6912,6915],{"style":4213},[13,6913],{"className":6914,"style":755},[205],[13,6916,6918],{"className":6917},[210,211,212,213],[13,6919,68],{"className":6920},[90,91,213],[13,6922,250],{"className":6923},[249],[13,6925,6927],{"className":6926},[193],[13,6928,6930],{"className":6929,"style":853},[197],[13,6931],{},[13,6933,4113],{"className":6934,"style":4237},[90,91],". Third, when the GPU evaluates ",[13,6937,6939,6979],{"className":6938},[50],[13,6940,6942],{"className":6941},[54],[56,6943,6944],{"xmlns":58},[60,6945,6946,6976],{},[63,6947,6948,6954,6956,6958,6964,6966,6968,6970],{},[782,6949,6950,6952],{},[66,6951,4100],{},[66,6953,68],{},[147,6955,566],{},[147,6957,539],{"stretchy":1079},[782,6959,6960,6962],{},[66,6961,3217],{},[66,6963,68],{},[66,6965,4113],{},[147,6967,440],{"stretchy":1079},[147,6969,780],{},[782,6971,6972,6974],{},[66,6973,17],{},[66,6975,68],{},[70,6977,6978],{"encoding":72},"D_x = (S_x X) + T_x",[13,6980,6982,7037,7101],{"className":6981,"ariaHidden":77},[76],[13,6983,6985,6988,7028,7031,7034],{"className":6984},[81],[13,6986],{"className":6987,"style":938},[85],[13,6989,6991,6994],{"className":6990},[90],[13,6992,4100],{"className":6993,"style":4140},[90,91],[13,6995,6997],{"className":6996},[739],[13,6998,7000,7020],{"className":6999},[188,189],[13,7001,7003,7017],{"className":7002},[193],[13,7004,7006],{"className":7005,"style":4153},[197],[13,7007,7008,7011],{"style":4156},[13,7009],{"className":7010,"style":755},[205],[13,7012,7014],{"className":7013},[210,211,212,213],[13,7015,68],{"className":7016},[90,91,213],[13,7018,250],{"className":7019},[249],[13,7021,7023],{"className":7022},[193],[13,7024,7026],{"className":7025,"style":853},[197],[13,7027],{},[13,7029],{"className":7030,"style":268},[267],[13,7032,566],{"className":7033},[272],[13,7035],{"className":7036,"style":268},[267],[13,7038,7040,7043,7046,7086,7089,7092,7095,7098],{"className":7039},[81],[13,7041],{"className":7042,"style":6163},[85],[13,7044,539],{"className":7045},[180],[13,7047,7049,7052],{"className":7048},[90],[13,7050,3217],{"className":7051,"style":4198},[90,91],[13,7053,7055],{"className":7054},[739],[13,7056,7058,7078],{"className":7057},[188,189],[13,7059,7061,7075],{"className":7060},[193],[13,7062,7064],{"className":7063,"style":4153},[197],[13,7065,7066,7069],{"style":4213},[13,7067],{"className":7068,"style":755},[205],[13,7070,7072],{"className":7071},[210,211,212,213],[13,7073,68],{"className":7074},[90,91,213],[13,7076,250],{"className":7077},[249],[13,7079,7081],{"className":7080},[193],[13,7082,7084],{"className":7083,"style":853},[197],[13,7085],{},[13,7087,4113],{"className":7088,"style":4237},[90,91],[13,7090,440],{"className":7091},[263],[13,7093],{"className":7094,"style":351},[267],[13,7096,780],{"className":7097},[355],[13,7099],{"className":7100,"style":351},[267],[13,7102,7104,7107],{"className":7103},[81],[13,7105],{"className":7106,"style":938},[85],[13,7108,7110,7113],{"className":7109},[90],[13,7111,17],{"className":7112,"style":4259},[90,91],[13,7114,7116],{"className":7115},[739],[13,7117,7119,7139],{"className":7118},[188,189],[13,7120,7122,7136],{"className":7121},[193],[13,7123,7125],{"className":7124,"style":4153},[197],[13,7126,7127,7130],{"style":4274},[13,7128],{"className":7129,"style":755},[205],[13,7131,7133],{"className":7132},[210,211,212,213],[13,7134,68],{"className":7135},[90,91,213],[13,7137,250],{"className":7138},[249],[13,7140,7142],{"className":7141},[193],[13,7143,7145],{"className":7144,"style":853},[197],[13,7146],{},", it adds a negative ",[13,7149,7151,7168],{"className":7150},[50],[13,7152,7154],{"className":7153},[54],[56,7155,7156],{"xmlns":58},[60,7157,7158,7166],{},[63,7159,7160],{},[782,7161,7162,7164],{},[66,7163,17],{},[66,7165,68],{},[70,7167,4392],{"encoding":72},[13,7169,7171],{"className":7170,"ariaHidden":77},[76],[13,7172,7174,7177],{"className":7173},[81],[13,7175],{"className":7176,"style":938},[85],[13,7178,7180,7183],{"className":7179},[90],[13,7181,17],{"className":7182,"style":4259},[90,91],[13,7184,7186],{"className":7185},[739],[13,7187,7189,7209],{"className":7188},[188,189],[13,7190,7192,7206],{"className":7191},[193],[13,7193,7195],{"className":7194,"style":4153},[197],[13,7196,7197,7200],{"style":4274},[13,7198],{"className":7199,"style":755},[205],[13,7201,7203],{"className":7202},[210,211,212,213],[13,7204,68],{"className":7205},[90,91,213],[13,7207,250],{"className":7208},[249],[13,7210,7212],{"className":7211},[193],[13,7213,7215],{"className":7214,"style":853},[197],[13,7216],{}," (for positive ",[13,7219,7221,7234],{"className":7220},[50],[13,7222,7224],{"className":7223},[54],[56,7225,7226],{"xmlns":58},[60,7227,7228,7232],{},[63,7229,7230],{},[66,7231,4113],{},[70,7233,4113],{"encoding":72},[13,7235,7237],{"className":7236,"ariaHidden":77},[76],[13,7238,7240,7243],{"className":7239},[81],[13,7241],{"className":7242,"style":6760},[85],[13,7244,4113],{"className":7245,"style":4237},[90,91]," and est). This is equivalent to:",[10,7248,7249],{},[13,7250,7252,7335],{"className":7251},[50],[13,7253,7255],{"className":7254},[54],[56,7256,7257],{"xmlns":58},[60,7258,7259,7332],{},[63,7260,7261,7267,7269,7271,7277,7279,7281,7283,7286,7292,7294,7296,7298,7304,7306,7308,7310,7312,7314,7316,7322,7324,7330],{},[782,7262,7263,7265],{},[66,7264,4100],{},[66,7266,68],{},[147,7268,566],{},[147,7270,539],{"stretchy":1079},[782,7272,7273,7275],{},[66,7274,3217],{},[66,7276,68],{},[66,7278,4113],{},[147,7280,440],{"stretchy":1079},[147,7282,329],{},[66,7284,7285],{"mathvariant":871},"∣",[782,7287,7288,7290],{},[66,7289,17],{},[66,7291,68],{},[66,7293,7285],{"mathvariant":871},[147,7295,566],{},[147,7297,539],{"stretchy":1079},[782,7299,7300,7302],{},[66,7301,3217],{},[66,7303,68],{},[66,7305,4113],{},[147,7307,440],{"stretchy":1079},[147,7309,329],{},[147,7311,539],{"stretchy":1079},[785,7313,4930],{},[147,7315,2628],{},[782,7317,7318,7320],{},[66,7319,3217],{},[66,7321,68],{},[147,7323,329],{},[782,7325,7326,7328],{},[66,7327,1272],{},[143,7329,1016],{},[147,7331,440],{"stretchy":1079},[70,7333,7334],{"encoding":72},"D_x = (S_x X) - |T_x| = (S_x X) - (\\text{est} \\cdot S_x - c_0)",[13,7336,7338,7393,7457,7518,7582,7606,7661],{"className":7337,"ariaHidden":77},[76],[13,7339,7341,7344,7384,7387,7390],{"className":7340},[81],[13,7342],{"className":7343,"style":938},[85],[13,7345,7347,7350],{"className":7346},[90],[13,7348,4100],{"className":7349,"style":4140},[90,91],[13,7351,7353],{"className":7352},[739],[13,7354,7356,7376],{"className":7355},[188,189],[13,7357,7359,7373],{"className":7358},[193],[13,7360,7362],{"className":7361,"style":4153},[197],[13,7363,7364,7367],{"style":4156},[13,7365],{"className":7366,"style":755},[205],[13,7368,7370],{"className":7369},[210,211,212,213],[13,7371,68],{"className":7372},[90,91,213],[13,7374,250],{"className":7375},[249],[13,7377,7379],{"className":7378},[193],[13,7380,7382],{"className":7381,"style":853},[197],[13,7383],{},[13,7385],{"className":7386,"style":268},[267],[13,7388,566],{"className":7389},[272],[13,7391],{"className":7392,"style":268},[267],[13,7394,7396,7399,7402,7442,7445,7448,7451,7454],{"className":7395},[81],[13,7397],{"className":7398,"style":6163},[85],[13,7400,539],{"className":7401},[180],[13,7403,7405,7408],{"className":7404},[90],[13,7406,3217],{"className":7407,"style":4198},[90,91],[13,7409,7411],{"className":7410},[739],[13,7412,7414,7434],{"className":7413},[188,189],[13,7415,7417,7431],{"className":7416},[193],[13,7418,7420],{"className":7419,"style":4153},[197],[13,7421,7422,7425],{"style":4213},[13,7423],{"className":7424,"style":755},[205],[13,7426,7428],{"className":7427},[210,211,212,213],[13,7429,68],{"className":7430},[90,91,213],[13,7432,250],{"className":7433},[249],[13,7435,7437],{"className":7436},[193],[13,7438,7440],{"className":7439,"style":853},[197],[13,7441],{},[13,7443,4113],{"className":7444,"style":4237},[90,91],[13,7446,440],{"className":7447},[263],[13,7449],{"className":7450,"style":351},[267],[13,7452,329],{"className":7453},[355],[13,7455],{"className":7456,"style":351},[267],[13,7458,7460,7463,7466,7506,7509,7512,7515],{"className":7459},[81],[13,7461],{"className":7462,"style":6163},[85],[13,7464,7285],{"className":7465},[90],[13,7467,7469,7472],{"className":7468},[90],[13,7470,17],{"className":7471,"style":4259},[90,91],[13,7473,7475],{"className":7474},[739],[13,7476,7478,7498],{"className":7477},[188,189],[13,7479,7481,7495],{"className":7480},[193],[13,7482,7484],{"className":7483,"style":4153},[197],[13,7485,7486,7489],{"style":4274},[13,7487],{"className":7488,"style":755},[205],[13,7490,7492],{"className":7491},[210,211,212,213],[13,7493,68],{"className":7494},[90,91,213],[13,7496,250],{"className":7497},[249],[13,7499,7501],{"className":7500},[193],[13,7502,7504],{"className":7503,"style":853},[197],[13,7505],{},[13,7507,7285],{"className":7508},[90],[13,7510],{"className":7511,"style":268},[267],[13,7513,566],{"className":7514},[272],[13,7516],{"className":7517,"style":268},[267],[13,7519,7521,7524,7527,7567,7570,7573,7576,7579],{"className":7520},[81],[13,7522],{"className":7523,"style":6163},[85],[13,7525,539],{"className":7526},[180],[13,7528,7530,7533],{"className":7529},[90],[13,7531,3217],{"className":7532,"style":4198},[90,91],[13,7534,7536],{"className":7535},[739],[13,7537,7539,7559],{"className":7538},[188,189],[13,7540,7542,7556],{"className":7541},[193],[13,7543,7545],{"className":7544,"style":4153},[197],[13,7546,7547,7550],{"style":4213},[13,7548],{"className":7549,"style":755},[205],[13,7551,7553],{"className":7552},[210,211,212,213],[13,7554,68],{"className":7555},[90,91,213],[13,7557,250],{"className":7558},[249],[13,7560,7562],{"className":7561},[193],[13,7563,7565],{"className":7564,"style":853},[197],[13,7566],{},[13,7568,4113],{"className":7569,"style":4237},[90,91],[13,7571,440],{"className":7572},[263],[13,7574],{"className":7575,"style":351},[267],[13,7577,329],{"className":7578},[355],[13,7580],{"className":7581,"style":351},[267],[13,7583,7585,7588,7591,7597,7600,7603],{"className":7584},[81],[13,7586],{"className":7587,"style":6163},[85],[13,7589,539],{"className":7590},[180],[13,7592,7594],{"className":7593},[90,687],[13,7595,4930],{"className":7596},[90],[13,7598],{"className":7599,"style":351},[267],[13,7601,2628],{"className":7602},[355],[13,7604],{"className":7605,"style":351},[267],[13,7607,7609,7612,7652,7655,7658],{"className":7608},[81],[13,7610],{"className":7611,"style":938},[85],[13,7613,7615,7618],{"className":7614},[90],[13,7616,3217],{"className":7617,"style":4198},[90,91],[13,7619,7621],{"className":7620},[739],[13,7622,7624,7644],{"className":7623},[188,189],[13,7625,7627,7641],{"className":7626},[193],[13,7628,7630],{"className":7629,"style":4153},[197],[13,7631,7632,7635],{"style":4213},[13,7633],{"className":7634,"style":755},[205],[13,7636,7638],{"className":7637},[210,211,212,213],[13,7639,68],{"className":7640},[90,91,213],[13,7642,250],{"className":7643},[249],[13,7645,7647],{"className":7646},[193],[13,7648,7650],{"className":7649,"style":853},[197],[13,7651],{},[13,7653],{"className":7654,"style":351},[267],[13,7656,329],{"className":7657},[355],[13,7659],{"className":7660,"style":351},[267],[13,7662,7664,7667,7707],{"className":7663},[81],[13,7665],{"className":7666,"style":6163},[85],[13,7668,7670,7673],{"className":7669},[90],[13,7671,1272],{"className":7672},[90,91],[13,7674,7676],{"className":7675},[739],[13,7677,7679,7699],{"className":7678},[188,189],[13,7680,7682,7696],{"className":7681},[193],[13,7683,7685],{"className":7684,"style":828},[197],[13,7686,7687,7690],{"style":5027},[13,7688],{"className":7689,"style":755},[205],[13,7691,7693],{"className":7692},[210,211,212,213],[13,7694,1016],{"className":7695},[90,213],[13,7697,250],{"className":7698},[249],[13,7700,7702],{"className":7701},[193],[13,7703,7705],{"className":7704,"style":853},[197],[13,7706],{},[13,7708,440],{"className":7709},[263],[10,7711,7712,7713,7783],{},"Since ",[13,7714,7716,7734],{"className":7715},[50],[13,7717,7719],{"className":7718},[54],[56,7720,7721],{"xmlns":58},[60,7722,7723,7731],{},[63,7724,7725],{},[782,7726,7727,7729],{},[66,7728,1272],{},[143,7730,1016],{},[70,7732,7733],{"encoding":72},"c_0",[13,7735,7737],{"className":7736,"ariaHidden":77},[76],[13,7738,7740,7743],{"className":7739},[81],[13,7741],{"className":7742,"style":5519},[85],[13,7744,7746,7749],{"className":7745},[90],[13,7747,1272],{"className":7748},[90,91],[13,7750,7752],{"className":7751},[739],[13,7753,7755,7775],{"className":7754},[188,189],[13,7756,7758,7772],{"className":7757},[193],[13,7759,7761],{"className":7760,"style":828},[197],[13,7762,7763,7766],{"style":5027},[13,7764],{"className":7765,"style":755},[205],[13,7767,7769],{"className":7768},[210,211,212,213],[13,7770,1016],{"className":7771},[90,213],[13,7773,250],{"className":7774},[249],[13,7776,7778],{"className":7777},[193],[13,7779,7781],{"className":7780,"style":853},[197],[13,7782],{}," (320) is small compared to the scaled values, the two operands are well within a factor of 2 of each other. Sterbenz's Lemma guarantees that the difference of any two floating-point numbers of the same sign within a factor of 2 of each other is computed with zero rounding error. The GPU thus renders the exact residual difference without losing any precision.",[10,7785,7786,7787,7821,7822,7892],{},"We read back the pixel centroid (",[13,7788,7790,7806],{"className":7789},[50],[13,7791,7793],{"className":7792},[54],[56,7794,7795],{"xmlns":58},[60,7796,7797,7803],{},[63,7798,7799,7801],{},[66,7800,1272],{},[66,7802,68],{},[70,7804,7805],{"encoding":72},"cx",[13,7807,7809],{"className":7808,"ariaHidden":77},[76],[13,7810,7812,7815,7818],{"className":7811},[81],[13,7813],{"className":7814,"style":86},[85],[13,7816,1272],{"className":7817},[90,91],[13,7819,68],{"className":7820},[90,91],") of the resulting strip to calculate the true ",[13,7823,7825,7843],{"className":7824},[50],[13,7826,7828],{"className":7827},[54],[56,7829,7830],{"xmlns":58},[60,7831,7832,7840],{},[63,7833,7834],{},[782,7835,7836,7838],{},[66,7837,4100],{},[66,7839,68],{},[70,7841,7842],{"encoding":72},"D_x",[13,7844,7846],{"className":7845,"ariaHidden":77},[76],[13,7847,7849,7852],{"className":7848},[81],[13,7850],{"className":7851,"style":938},[85],[13,7853,7855,7858],{"className":7854},[90],[13,7856,4100],{"className":7857,"style":4140},[90,91],[13,7859,7861],{"className":7860},[739],[13,7862,7864,7884],{"className":7863},[188,189],[13,7865,7867,7881],{"className":7866},[193],[13,7868,7870],{"className":7869,"style":4153},[197],[13,7871,7872,7875],{"style":4156},[13,7873],{"className":7874,"style":755},[205],[13,7876,7878],{"className":7877},[210,211,212,213],[13,7879,68],{"className":7880},[90,91,213],[13,7882,250],{"className":7883},[249],[13,7885,7887],{"className":7886},[193],[13,7888,7890],{"className":7889,"style":853},[197],[13,7891],{},". We then invert the math to update our estimate:",[10,7894,7895],{},[13,7896,7898,7950],{"className":7897},[50],[13,7899,7901],{"className":7900},[54],[56,7902,7903],{"xmlns":58},[60,7904,7905,7947],{},[63,7906,7907,7913,7915],{},[782,7908,7909,7911],{},[785,7910,4930],{},[785,7912,3893],{},[147,7914,566],{},[138,7916,7917,7941],{},[63,7918,7919,7921,7924,7926,7928,7930,7933,7935],{},[143,7920,145],{},[785,7922,7923],{}," ",[66,7925,1272],{},[66,7927,68],{},[147,7929,329],{},[66,7931,7932],{},"E",[147,7934,329],{},[782,7936,7937,7939],{},[66,7938,17],{},[66,7940,68],{},[782,7942,7943,7945],{},[66,7944,3217],{},[66,7946,68],{},[70,7948,7949],{"encoding":72},"\\text{est}_{\\text{new}} = \\frac{2 \\, cx - E - T_x}{S_x}",[13,7951,7953,8018],{"className":7952,"ariaHidden":77},[76],[13,7954,7956,7960,8009,8012,8015],{"className":7955},[81],[13,7957],{"className":7958,"style":7959},[85],"height:0.7651em;vertical-align:-0.15em;",[13,7961,7963,7969],{"className":7962},[90],[13,7964,7966],{"className":7965},[90,687],[13,7967,4930],{"className":7968},[90],[13,7970,7972],{"className":7971},[739],[13,7973,7975,8001],{"className":7974},[188,189],[13,7976,7978,7998],{"className":7977},[193],[13,7979,7981],{"className":7980,"style":4153},[197],[13,7982,7983,7986],{"style":831},[13,7984],{"className":7985,"style":755},[205],[13,7987,7989],{"className":7988},[210,211,212,213],[13,7990,7992],{"className":7991},[90,213],[13,7993,7995],{"className":7994},[90,687,213],[13,7996,3893],{"className":7997},[90,213],[13,7999,250],{"className":8000},[249],[13,8002,8004],{"className":8003},[193],[13,8005,8007],{"className":8006,"style":853},[197],[13,8008],{},[13,8010],{"className":8011,"style":268},[267],[13,8013,566],{"className":8014},[272],[13,8016],{"className":8017,"style":268},[267],[13,8019,8021,8025],{"className":8020},[81],[13,8022],{"className":8023,"style":8024},[85],"height:1.3335em;vertical-align:-0.4451em;",[13,8026,8028,8031,8195],{"className":8027},[90],[13,8029],{"className":8030},[180,181],[13,8032,8034],{"className":8033},[138],[13,8035,8037,8186],{"className":8036},[188,189],[13,8038,8040,8183],{"className":8039},[193],[13,8041,8044,8100,8108],{"className":8042,"style":8043},[197],"height:0.8884em;",[13,8045,8046,8049],{"style":201},[13,8047],{"className":8048,"style":206},[205],[13,8050,8052],{"className":8051},[210,211,212,213],[13,8053,8055],{"className":8054},[90,213],[13,8056,8058,8061],{"className":8057},[90,213],[13,8059,3217],{"className":8060,"style":4198},[90,91,213],[13,8062,8064],{"className":8063},[739],[13,8065,8067,8091],{"className":8066},[188,189],[13,8068,8070,8088],{"className":8069},[193],[13,8071,8074],{"className":8072,"style":8073},[197],"height:0.1645em;",[13,8075,8077,8081],{"style":8076},"top:-2.357em;margin-left:-0.0576em;margin-right:0.0714em;",[13,8078],{"className":8079,"style":8080},[205],"height:2.5em;",[13,8082,8085],{"className":8083},[210,8084,1521,213],"reset-size3",[13,8086,68],{"className":8087},[90,91,213],[13,8089,250],{"className":8090},[249],[13,8092,8094],{"className":8093},[193],[13,8095,8098],{"className":8096,"style":8097},[197],"height:0.143em;",[13,8099],{},[13,8101,8102,8105],{"style":222},[13,8103],{"className":8104,"style":206},[205],[13,8106],{"className":8107,"style":230},[229],[13,8109,8111,8114],{"style":8110},"top:-3.4101em;",[13,8112],{"className":8113,"style":206},[205],[13,8115,8117],{"className":8116},[210,211,212,213],[13,8118,8120,8123,8127,8130,8133,8136,8139,8142],{"className":8119},[90,213],[13,8121,145],{"className":8122},[90,213],[13,8124],{"className":8125,"style":8126},[267,213],"margin-right:0.1952em;",[13,8128,1272],{"className":8129},[90,91,213],[13,8131,68],{"className":8132},[90,91,213],[13,8134,329],{"className":8135},[355,213],[13,8137,7932],{"className":8138,"style":4198},[90,91,213],[13,8140,329],{"className":8141},[355,213],[13,8143,8145,8148],{"className":8144},[90,213],[13,8146,17],{"className":8147,"style":4259},[90,91,213],[13,8149,8151],{"className":8150},[739],[13,8152,8154,8175],{"className":8153},[188,189],[13,8155,8157,8172],{"className":8156},[193],[13,8158,8160],{"className":8159,"style":8073},[197],[13,8161,8163,8166],{"style":8162},"top:-2.357em;margin-left:-0.1389em;margin-right:0.0714em;",[13,8164],{"className":8165,"style":8080},[205],[13,8167,8169],{"className":8168},[210,8084,1521,213],[13,8170,68],{"className":8171},[90,91,213],[13,8173,250],{"className":8174},[249],[13,8176,8178],{"className":8177},[193],[13,8179,8181],{"className":8180,"style":8097},[197],[13,8182],{},[13,8184,250],{"className":8185},[249],[13,8187,8189],{"className":8188},[193],[13,8190,8193],{"className":8191,"style":8192},[197],"height:0.4451em;",[13,8194],{},[13,8196],{"className":8197},[263,181],[10,8199,8200,8201,8229,8230,8299,8300,8360,8361,8443,8444,8504,8505,8564],{},"where ",[13,8202,8204,8217],{"className":8203},[50],[13,8205,8207],{"className":8206},[54],[56,8208,8209],{"xmlns":58},[60,8210,8211,8215],{},[63,8212,8213],{},[66,8214,7932],{},[70,8216,7932],{"encoding":72},[13,8218,8220],{"className":8219,"ariaHidden":77},[76],[13,8221,8223,8226],{"className":8222},[81],[13,8224],{"className":8225,"style":6760},[85],[13,8227,7932],{"className":8228,"style":4198},[90,91]," is the screen edge (0 or 640). The three refinement rounds set ",[13,8231,8233,8250],{"className":8232},[50],[13,8234,8236],{"className":8235},[54],[56,8237,8238],{"xmlns":58},[60,8239,8240,8248],{},[63,8241,8242],{},[782,8243,8244,8246],{},[66,8245,3217],{},[66,8247,68],{},[70,8249,4321],{"encoding":72},[13,8251,8253],{"className":8252,"ariaHidden":77},[76],[13,8254,8256,8259],{"className":8255},[81],[13,8257],{"className":8258,"style":938},[85],[13,8260,8262,8265],{"className":8261},[90],[13,8263,3217],{"className":8264,"style":4198},[90,91],[13,8266,8268],{"className":8267},[739],[13,8269,8271,8291],{"className":8270},[188,189],[13,8272,8274,8288],{"className":8273},[193],[13,8275,8277],{"className":8276,"style":4153},[197],[13,8278,8279,8282],{"style":4213},[13,8280],{"className":8281,"style":755},[205],[13,8283,8285],{"className":8284},[210,211,212,213],[13,8286,68],{"className":8287},[90,91,213],[13,8289,250],{"className":8290},[249],[13,8292,8294],{"className":8293},[193],[13,8295,8297],{"className":8296,"style":853},[197],[13,8298],{}," to ",[13,8301,8303,8321],{"className":8302},[50],[13,8304,8306],{"className":8305},[54],[56,8307,8308],{"xmlns":58},[60,8309,8310,8318],{},[63,8311,8312],{},[710,8313,8314,8316],{},[143,8315,145],{},[66,8317,1267],{},[70,8319,8320],{"encoding":72},"2^d",[13,8322,8324],{"className":8323,"ariaHidden":77},[76],[13,8325,8327,8331],{"className":8326},[81],[13,8328],{"className":8329,"style":8330},[85],"height:0.8491em;",[13,8332,8334,8337],{"className":8333},[90],[13,8335,145],{"className":8336},[90],[13,8338,8340],{"className":8339},[739],[13,8341,8343],{"className":8342},[188],[13,8344,8346],{"className":8345},[193],[13,8347,8349],{"className":8348,"style":8330},[197],[13,8350,8351,8354],{"style":751},[13,8352],{"className":8353,"style":755},[205],[13,8355,8357],{"className":8356},[210,211,212,213],[13,8358,1267],{"className":8359},[90,91,213]," times the coarse-search scale, with ",[13,8362,8364,8393],{"className":8363},[50],[13,8365,8367],{"className":8366},[54],[56,8368,8369],{"xmlns":58},[60,8370,8371,8390],{},[63,8372,8373,8375,8377,8380,8382,8385,8387],{},[66,8374,1267],{},[147,8376,566],{},[143,8378,8379],{},"6",[147,8381,160],{"separator":77},[143,8383,8384],{},"11",[147,8386,160],{"separator":77},[143,8388,8389],{},"15",[70,8391,8392],{"encoding":72},"d = 6, 11, 15",[13,8394,8396,8415],{"className":8395,"ariaHidden":77},[76],[13,8397,8399,8403,8406,8409,8412],{"className":8398},[81],[13,8400],{"className":8401,"style":8402},[85],"height:0.6944em;",[13,8404,1267],{"className":8405},[90,91],[13,8407],{"className":8408,"style":268},[267],[13,8410,566],{"className":8411},[272],[13,8413],{"className":8414,"style":268},[267],[13,8416,8418,8421,8424,8427,8431,8434,8437,8440],{"className":8417},[81],[13,8419],{"className":8420,"style":301},[85],[13,8422,8379],{"className":8423},[90],[13,8425,160],{"className":8426},[311],[13,8428],{"className":8429,"style":8430},[267],"margin-right:0.1667em;",[13,8432,8384],{"className":8433},[90],[13,8435,160],{"className":8436},[311],[13,8438],{"className":8439,"style":8430},[267],[13,8441,8389],{"className":8442},[90],"; successive rounds therefore zoom in by ",[13,8445,8447,8466],{"className":8446},[50],[13,8448,8450],{"className":8449},[54],[56,8451,8452],{"xmlns":58},[60,8453,8454,8463],{},[63,8455,8456],{},[710,8457,8458,8460],{},[143,8459,145],{},[143,8461,8462],{},"5",[70,8464,8465],{"encoding":72},"2^5",[13,8467,8469],{"className":8468,"ariaHidden":77},[76],[13,8470,8472,8475],{"className":8471},[81],[13,8473],{"className":8474,"style":729},[85],[13,8476,8478,8481],{"className":8477},[90],[13,8479,145],{"className":8480},[90],[13,8482,8484],{"className":8483},[739],[13,8485,8487],{"className":8486},[188],[13,8488,8490],{"className":8489},[193],[13,8491,8493],{"className":8492,"style":729},[197],[13,8494,8495,8498],{"style":751},[13,8496],{"className":8497,"style":755},[205],[13,8499,8501],{"className":8500},[210,211,212,213],[13,8502,8462],{"className":8503},[90,213]," then ",[13,8506,8508,8526],{"className":8507},[50],[13,8509,8511],{"className":8510},[54],[56,8512,8513],{"xmlns":58},[60,8514,8515,8523],{},[63,8516,8517],{},[710,8518,8519,8521],{},[143,8520,145],{},[143,8522,2961],{},[70,8524,8525],{"encoding":72},"2^4",[13,8527,8529],{"className":8528,"ariaHidden":77},[76],[13,8530,8532,8535],{"className":8531},[81],[13,8533],{"className":8534,"style":729},[85],[13,8536,8538,8541],{"className":8537},[90],[13,8539,145],{"className":8540},[90],[13,8542,8544],{"className":8543},[739],[13,8545,8547],{"className":8546},[188],[13,8548,8550],{"className":8549},[193],[13,8551,8553],{"className":8552,"style":729},[197],[13,8554,8555,8558],{"style":751},[13,8556],{"className":8557,"style":755},[205],[13,8559,8561],{"className":8560},[210,211,212,213],[13,8562,2961],{"className":8563},[90,213],", re-centering the viewport to resolve progressively finer mantissa bits.",[10,8566,8567],{},"Each readback probe reads from the already corrupted and cached path in GPU memory, without re-triggering the expensive 1.43B-verb cascade. This asymmetry lets us probe 4-9 times per c1read without incurring massive performance costs.",[487,8569,8570],{"type":489},[10,8571,8572],{},"Power-of-2 scaling avoids mantissa rounding; Sterbenz's Lemma makes the GPU's subtraction exact. Each probe refines the float without losing bits.",[10,8574,8575],{},"Rendering on a canvas is a 2-dimensional operation. However, if the line is axis-aligned then we can reduce the problem into the solvable 1D one above. Let's handle the easy case first.",[449,8577,8579],{"id":8578},"leaking-aslr-vptr","Leaking ASLR (vptr)",[10,8581,8582],{},"The ASLR leak relies on three known inputs. First, we know the heap address of the RasterDecoderImpl object, which was leaked via the Logger earlier. This heap address allows us to forge a pointer W to point inside the object. Second, we know the relative layout of the compiled chrome.so library, including the build-constant offsets (Relative Virtual Addresses, or RVAs) between symbols and the load base. Third, we know that chrome.so is aligned to a 4 KiB page boundary, so the low 12 bits of any library pointer are predictable.",[10,8584,8585],{},"What we do not know is the randomized load address of chrome.so (chrome_base) or the absolute 64-bit virtual addresses of its vtable pointers.",[10,8587,8588],{},"To locate chrome_base, we must resolve the absolute value of the primary vtable pointer. RasterDecoderImpl uses multiple inheritance, meaning the compiler places two vtable pointers at the start of the object: vptr1 at offset 0x00, and vptr2 (which points to vptr1 + 0x260) at offset 0x08. Because both point into the same read-only segment of chrome.so and differ only by the static 0x260 offset, their middle bytes (2..5) are usually identical.",[10,8590,8591],{},"By setting the forged coordinate array pointer W to decoder + 2, we force Skia to read the object memory as point coordinates. Each point in a path is represented as an SkPoint struct, consisting of two 32-bit floats (fX and fY). This results in the following little-endian byte alignment:",[8593,8594],"diagram-bytes",{":columns":8595,":rows":8596,":brackets":8597,":pointer":8598,"columnNote":8599},"[\"0\",\"1\",\"2\",\"3\",\"4\",\"5\",\"6\",\"7\",\"8\",\"9\",\"A\",\"B\",\"C\",\"D\",\"E\",\"F\",\"\",\"\"]","[{\"fields\":[{\"label\":\"vptr1\",\"start\":0,\"span\":8},{\"label\":\"vptr2\",\"start\":8,\"span\":8}]},{\"fields\":[{\"label\":\"vptr1[0..1]\",\"start\":0,\"span\":2},{\"label\":\"vptr1[2..5]\",\"start\":2,\"span\":4},{\"label\":\"vptr1[6..7]\",\"start\":6,\"span\":2},{\"label\":\"vptr2[0..1]\",\"start\":8,\"span\":2},{\"label\":\"vptr2[2..5]\",\"start\":10,\"span\":4},{\"label\":\"vptr2[6..7]\",\"start\":14,\"span\":2}]},{\"fields\":[{\"label\":\"P0.x\",\"sub\":\"(float32)\",\"start\":2,\"span\":4},{\"label\":\"P0.y\",\"sub\":\"(float32)\",\"start\":6,\"span\":4},{\"label\":\"P1.x\",\"sub\":\"(float32)\",\"start\":10,\"span\":4},{\"label\":\"P1.y\",\"sub\":\"(float32)\",\"start\":14,\"span\":4}]}]","[{\"label\":\"Point P0\",\"start\":2,\"span\":8},{\"label\":\"Point P1\",\"start\":10,\"span\":8}]","{\"label\":\"W = decoder + 2\",\"atColumn\":2}","(Offset)",[10,8601,8602],{},"Since W starts at decoder + 2:",[410,8604,8605,8874,9152],{},[413,8606,8607,8687,8688,8791,8792,440],{},[13,8608,8610,8632],{"className":8609},[50],[13,8611,8613],{"className":8612},[54],[56,8614,8615],{"xmlns":58},[60,8616,8617,8629],{},[63,8618,8619],{},[782,8620,8621,8623],{},[66,8622,3262],{},[63,8624,8625,8627],{},[143,8626,1016],{},[66,8628,68],{},[70,8630,8631],{"encoding":72},"P_{0x}",[13,8633,8635],{"className":8634,"ariaHidden":77},[76],[13,8636,8638,8641],{"className":8637},[81],[13,8639],{"className":8640,"style":938},[85],[13,8642,8644,8647],{"className":8643},[90],[13,8645,3262],{"className":8646,"style":4259},[90,91],[13,8648,8650],{"className":8649},[739],[13,8651,8653,8679],{"className":8652},[188,189],[13,8654,8656,8676],{"className":8655},[193],[13,8657,8659],{"className":8658,"style":828},[197],[13,8660,8661,8664],{"style":4274},[13,8662],{"className":8663,"style":755},[205],[13,8665,8667],{"className":8666},[210,211,212,213],[13,8668,8670,8673],{"className":8669},[90,213],[13,8671,1016],{"className":8672},[90,213],[13,8674,68],{"className":8675},[90,91,213],[13,8677,250],{"className":8678},[249],[13,8680,8682],{"className":8681},[193],[13,8683,8685],{"className":8684,"style":853},[197],[13,8686],{}," overlays ",[13,8689,8691,8726],{"className":8690},[50],[13,8692,8694],{"className":8693},[54],[56,8695,8696],{"xmlns":58},[60,8697,8698,8723],{},[63,8699,8700,8714,8717,8720],{},[782,8701,8702,8712],{},[63,8703,8704,8706,8708,8710],{},[66,8705,2567],{"mathvariant":871},[66,8707,10],{"mathvariant":871},[66,8709,1194],{"mathvariant":871},[66,8711,890],{"mathvariant":871},[143,8713,1085],{},[147,8715,8716],{"stretchy":1079},"[",[143,8718,8719],{},"2..5",[147,8721,8722],{"stretchy":1079},"]",[70,8724,8725],{"encoding":72},"\\mathrm{vptr}_1[2..5]",[13,8727,8729],{"className":8728,"ariaHidden":77},[76],[13,8730,8732,8735,8782,8785,8788],{"className":8731},[81],[13,8733],{"className":8734,"style":6163},[85],[13,8736,8738,8745],{"className":8737},[90],[13,8739,8741],{"className":8740},[90],[13,8742,8744],{"className":8743},[90,922],"vptr",[13,8746,8748],{"className":8747},[739],[13,8749,8751,8773],{"className":8750},[188,189],[13,8752,8754,8770],{"className":8753},[193],[13,8755,8758],{"className":8756,"style":8757},[197],"height:0.207em;",[13,8759,8761,8764],{"style":8760},"top:-2.4559em;margin-right:0.05em;",[13,8762],{"className":8763,"style":755},[205],[13,8765,8767],{"className":8766},[210,211,212,213],[13,8768,1085],{"className":8769},[90,213],[13,8771,250],{"className":8772},[249],[13,8774,8776],{"className":8775},[193],[13,8777,8780],{"className":8778,"style":8779},[197],"height:0.2441em;",[13,8781],{},[13,8783,8716],{"className":8784},[180],[13,8786,8719],{"className":8787},[90],[13,8789,8722],{"className":8790},[263]," (middle bytes of ",[13,8793,8795,8821],{"className":8794},[50],[13,8796,8798],{"className":8797},[54],[56,8799,8800],{"xmlns":58},[60,8801,8802,8818],{},[63,8803,8804],{},[782,8805,8806,8816],{},[63,8807,8808,8810,8812,8814],{},[66,8809,2567],{"mathvariant":871},[66,8811,10],{"mathvariant":871},[66,8813,1194],{"mathvariant":871},[66,8815,890],{"mathvariant":871},[143,8817,1085],{},[70,8819,8820],{"encoding":72},"\\mathrm{vptr}_1",[13,8822,8824],{"className":8823,"ariaHidden":77},[76],[13,8825,8827,8831],{"className":8826},[81],[13,8828],{"className":8829,"style":8830},[85],"height:0.8592em;vertical-align:-0.2441em;",[13,8832,8834,8840],{"className":8833},[90],[13,8835,8837],{"className":8836},[90],[13,8838,8744],{"className":8839},[90,922],[13,8841,8843],{"className":8842},[739],[13,8844,8846,8866],{"className":8845},[188,189],[13,8847,8849,8863],{"className":8848},[193],[13,8850,8852],{"className":8851,"style":8757},[197],[13,8853,8854,8857],{"style":8760},[13,8855],{"className":8856,"style":755},[205],[13,8858,8860],{"className":8859},[210,211,212,213],[13,8861,1085],{"className":8862},[90,213],[13,8864,250],{"className":8865},[249],[13,8867,8869],{"className":8868},[193],[13,8870,8872],{"className":8871,"style":8779},[197],[13,8873],{},[413,8875,8876,8687,8958,92,9055],{},[13,8877,8879,8901],{"className":8878},[50],[13,8880,8882],{"className":8881},[54],[56,8883,8884],{"xmlns":58},[60,8885,8886,8898],{},[63,8887,8888],{},[782,8889,8890,8892],{},[66,8891,3262],{},[63,8893,8894,8896],{},[143,8895,1016],{},[66,8897,107],{},[70,8899,8900],{"encoding":72},"P_{0y}",[13,8902,8904],{"className":8903,"ariaHidden":77},[76],[13,8905,8907,8911],{"className":8906},[81],[13,8908],{"className":8909,"style":8910},[85],"height:0.9694em;vertical-align:-0.2861em;",[13,8912,8914,8917],{"className":8913},[90],[13,8915,3262],{"className":8916,"style":4259},[90,91],[13,8918,8920],{"className":8919},[739],[13,8921,8923,8949],{"className":8922},[188,189],[13,8924,8926,8946],{"className":8925},[193],[13,8927,8929],{"className":8928,"style":828},[197],[13,8930,8931,8934],{"style":4274},[13,8932],{"className":8933,"style":755},[205],[13,8935,8937],{"className":8936},[210,211,212,213],[13,8938,8940,8943],{"className":8939},[90,213],[13,8941,1016],{"className":8942},[90,213],[13,8944,107],{"className":8945,"style":123},[90,91,213],[13,8947,250],{"className":8948},[249],[13,8950,8952],{"className":8951},[193],[13,8953,8956],{"className":8954,"style":8955},[197],"height:0.2861em;",[13,8957],{},[13,8959,8961,8994],{"className":8960},[50],[13,8962,8964],{"className":8963},[54],[56,8965,8966],{"xmlns":58},[60,8967,8968,8991],{},[63,8969,8970,8984,8986,8989],{},[782,8971,8972,8982],{},[63,8973,8974,8976,8978,8980],{},[66,8975,2567],{"mathvariant":871},[66,8977,10],{"mathvariant":871},[66,8979,1194],{"mathvariant":871},[66,8981,890],{"mathvariant":871},[143,8983,1085],{},[147,8985,8716],{"stretchy":1079},[143,8987,8988],{},"6..7",[147,8990,8722],{"stretchy":1079},[70,8992,8993],{"encoding":72},"\\mathrm{vptr}_1[6..7]",[13,8995,8997],{"className":8996,"ariaHidden":77},[76],[13,8998,9000,9003,9046,9049,9052],{"className":8999},[81],[13,9001],{"className":9002,"style":6163},[85],[13,9004,9006,9012],{"className":9005},[90],[13,9007,9009],{"className":9008},[90],[13,9010,8744],{"className":9011},[90,922],[13,9013,9015],{"className":9014},[739],[13,9016,9018,9038],{"className":9017},[188,189],[13,9019,9021,9035],{"className":9020},[193],[13,9022,9024],{"className":9023,"style":8757},[197],[13,9025,9026,9029],{"style":8760},[13,9027],{"className":9028,"style":755},[205],[13,9030,9032],{"className":9031},[210,211,212,213],[13,9033,1085],{"className":9034},[90,213],[13,9036,250],{"className":9037},[249],[13,9039,9041],{"className":9040},[193],[13,9042,9044],{"className":9043,"style":8779},[197],[13,9045],{},[13,9047,8716],{"className":9048},[180],[13,9050,8988],{"className":9051},[90],[13,9053,8722],{"className":9054},[263],[13,9056,9058,9091],{"className":9057},[50],[13,9059,9061],{"className":9060},[54],[56,9062,9063],{"xmlns":58},[60,9064,9065,9088],{},[63,9066,9067,9081,9083,9086],{},[782,9068,9069,9079],{},[63,9070,9071,9073,9075,9077],{},[66,9072,2567],{"mathvariant":871},[66,9074,10],{"mathvariant":871},[66,9076,1194],{"mathvariant":871},[66,9078,890],{"mathvariant":871},[143,9080,145],{},[147,9082,8716],{"stretchy":1079},[143,9084,9085],{},"0..1",[147,9087,8722],{"stretchy":1079},[70,9089,9090],{"encoding":72},"\\mathrm{vptr}_2[0..1]",[13,9092,9094],{"className":9093,"ariaHidden":77},[76],[13,9095,9097,9100,9143,9146,9149],{"className":9096},[81],[13,9098],{"className":9099,"style":6163},[85],[13,9101,9103,9109],{"className":9102},[90],[13,9104,9106],{"className":9105},[90],[13,9107,8744],{"className":9108},[90,922],[13,9110,9112],{"className":9111},[739],[13,9113,9115,9135],{"className":9114},[188,189],[13,9116,9118,9132],{"className":9117},[193],[13,9119,9121],{"className":9120,"style":8757},[197],[13,9122,9123,9126],{"style":8760},[13,9124],{"className":9125,"style":755},[205],[13,9127,9129],{"className":9128},[210,211,212,213],[13,9130,145],{"className":9131},[90,213],[13,9133,250],{"className":9134},[249],[13,9136,9138],{"className":9137},[193],[13,9139,9141],{"className":9140,"style":8779},[197],[13,9142],{},[13,9144,8716],{"className":9145},[180],[13,9147,9085],{"className":9148},[90],[13,9150,8722],{"className":9151},[263],[413,9153,9154,8687,9234,8791,9330,440],{},[13,9155,9157,9179],{"className":9156},[50],[13,9158,9160],{"className":9159},[54],[56,9161,9162],{"xmlns":58},[60,9163,9164,9176],{},[63,9165,9166],{},[782,9167,9168,9170],{},[66,9169,3262],{},[63,9171,9172,9174],{},[143,9173,1085],{},[66,9175,68],{},[70,9177,9178],{"encoding":72},"P_{1x}",[13,9180,9182],{"className":9181,"ariaHidden":77},[76],[13,9183,9185,9188],{"className":9184},[81],[13,9186],{"className":9187,"style":938},[85],[13,9189,9191,9194],{"className":9190},[90],[13,9192,3262],{"className":9193,"style":4259},[90,91],[13,9195,9197],{"className":9196},[739],[13,9198,9200,9226],{"className":9199},[188,189],[13,9201,9203,9223],{"className":9202},[193],[13,9204,9206],{"className":9205,"style":828},[197],[13,9207,9208,9211],{"style":4274},[13,9209],{"className":9210,"style":755},[205],[13,9212,9214],{"className":9213},[210,211,212,213],[13,9215,9217,9220],{"className":9216},[90,213],[13,9218,1085],{"className":9219},[90,213],[13,9221,68],{"className":9222},[90,91,213],[13,9224,250],{"className":9225},[249],[13,9227,9229],{"className":9228},[193],[13,9230,9232],{"className":9231,"style":853},[197],[13,9233],{},[13,9235,9237,9269],{"className":9236},[50],[13,9238,9240],{"className":9239},[54],[56,9241,9242],{"xmlns":58},[60,9243,9244,9266],{},[63,9245,9246,9260,9262,9264],{},[782,9247,9248,9258],{},[63,9249,9250,9252,9254,9256],{},[66,9251,2567],{"mathvariant":871},[66,9253,10],{"mathvariant":871},[66,9255,1194],{"mathvariant":871},[66,9257,890],{"mathvariant":871},[143,9259,145],{},[147,9261,8716],{"stretchy":1079},[143,9263,8719],{},[147,9265,8722],{"stretchy":1079},[70,9267,9268],{"encoding":72},"\\mathrm{vptr}_2[2..5]",[13,9270,9272],{"className":9271,"ariaHidden":77},[76],[13,9273,9275,9278,9321,9324,9327],{"className":9274},[81],[13,9276],{"className":9277,"style":6163},[85],[13,9279,9281,9287],{"className":9280},[90],[13,9282,9284],{"className":9283},[90],[13,9285,8744],{"className":9286},[90,922],[13,9288,9290],{"className":9289},[739],[13,9291,9293,9313],{"className":9292},[188,189],[13,9294,9296,9310],{"className":9295},[193],[13,9297,9299],{"className":9298,"style":8757},[197],[13,9300,9301,9304],{"style":8760},[13,9302],{"className":9303,"style":755},[205],[13,9305,9307],{"className":9306},[210,211,212,213],[13,9308,145],{"className":9309},[90,213],[13,9311,250],{"className":9312},[249],[13,9314,9316],{"className":9315},[193],[13,9317,9319],{"className":9318,"style":8779},[197],[13,9320],{},[13,9322,8716],{"className":9323},[180],[13,9325,8719],{"className":9326},[90],[13,9328,8722],{"className":9329},[263],[13,9331,9333,9359],{"className":9332},[50],[13,9334,9336],{"className":9335},[54],[56,9337,9338],{"xmlns":58},[60,9339,9340,9356],{},[63,9341,9342],{},[782,9343,9344,9354],{},[63,9345,9346,9348,9350,9352],{},[66,9347,2567],{"mathvariant":871},[66,9349,10],{"mathvariant":871},[66,9351,1194],{"mathvariant":871},[66,9353,890],{"mathvariant":871},[143,9355,145],{},[70,9357,9358],{"encoding":72},"\\mathrm{vptr}_2",[13,9360,9362],{"className":9361,"ariaHidden":77},[76],[13,9363,9365,9368],{"className":9364},[81],[13,9366],{"className":9367,"style":8830},[85],[13,9369,9371,9377],{"className":9370},[90],[13,9372,9374],{"className":9373},[90],[13,9375,8744],{"className":9376},[90,922],[13,9378,9380],{"className":9379},[739],[13,9381,9383,9403],{"className":9382},[188,189],[13,9384,9386,9400],{"className":9385},[193],[13,9387,9389],{"className":9388,"style":8757},[197],[13,9390,9391,9394],{"style":8760},[13,9392],{"className":9393,"style":755},[205],[13,9395,9397],{"className":9396},[210,211,212,213],[13,9398,145],{"className":9399},[90,213],[13,9401,250],{"className":9402},[249],[13,9404,9406],{"className":9405},[193],[13,9407,9409],{"className":9408,"style":8779},[197],[13,9410],{},[10,9412,9413,9414,92,9494,9574,9575,9760,9761,9840,9841,9920,9921,10000],{},"Because the middle bytes of ",[13,9415,9417,9442],{"className":9416},[50],[13,9418,9420],{"className":9419},[54],[56,9421,9422],{"xmlns":58},[60,9423,9424,9440],{},[63,9425,9426],{},[782,9427,9428,9438],{},[63,9429,9430,9432,9434,9436],{},[66,9431,2567],{"mathvariant":871},[66,9433,10],{"mathvariant":871},[66,9435,1194],{"mathvariant":871},[66,9437,890],{"mathvariant":871},[143,9439,1085],{},[70,9441,8820],{"encoding":72},[13,9443,9445],{"className":9444,"ariaHidden":77},[76],[13,9446,9448,9451],{"className":9447},[81],[13,9449],{"className":9450,"style":8830},[85],[13,9452,9454,9460],{"className":9453},[90],[13,9455,9457],{"className":9456},[90],[13,9458,8744],{"className":9459},[90,922],[13,9461,9463],{"className":9462},[739],[13,9464,9466,9486],{"className":9465},[188,189],[13,9467,9469,9483],{"className":9468},[193],[13,9470,9472],{"className":9471,"style":8757},[197],[13,9473,9474,9477],{"style":8760},[13,9475],{"className":9476,"style":755},[205],[13,9478,9480],{"className":9479},[210,211,212,213],[13,9481,1085],{"className":9482},[90,213],[13,9484,250],{"className":9485},[249],[13,9487,9489],{"className":9488},[193],[13,9490,9492],{"className":9491,"style":8779},[197],[13,9493],{},[13,9495,9497,9522],{"className":9496},[50],[13,9498,9500],{"className":9499},[54],[56,9501,9502],{"xmlns":58},[60,9503,9504,9520],{},[63,9505,9506],{},[782,9507,9508,9518],{},[63,9509,9510,9512,9514,9516],{},[66,9511,2567],{"mathvariant":871},[66,9513,10],{"mathvariant":871},[66,9515,1194],{"mathvariant":871},[66,9517,890],{"mathvariant":871},[143,9519,145],{},[70,9521,9358],{"encoding":72},[13,9523,9525],{"className":9524,"ariaHidden":77},[76],[13,9526,9528,9531],{"className":9527},[81],[13,9529],{"className":9530,"style":8830},[85],[13,9532,9534,9540],{"className":9533},[90],[13,9535,9537],{"className":9536},[90],[13,9538,8744],{"className":9539},[90,922],[13,9541,9543],{"className":9542},[739],[13,9544,9546,9566],{"className":9545},[188,189],[13,9547,9549,9563],{"className":9548},[193],[13,9550,9552],{"className":9551,"style":8757},[197],[13,9553,9554,9557],{"style":8760},[13,9555],{"className":9556,"style":755},[205],[13,9558,9560],{"className":9559},[210,211,212,213],[13,9561,145],{"className":9562},[90,213],[13,9564,250],{"className":9565},[249],[13,9567,9569],{"className":9568},[193],[13,9570,9572],{"className":9571,"style":8779},[197],[13,9573],{}," are identical (",[13,9576,9578,9632],{"className":9577},[50],[13,9579,9581],{"className":9580},[54],[56,9582,9583],{"xmlns":58},[60,9584,9585,9629],{},[63,9586,9587,9601,9603,9605,9607,9609,9623,9625,9627],{},[782,9588,9589,9599],{},[63,9590,9591,9593,9595,9597],{},[66,9592,2567],{"mathvariant":871},[66,9594,10],{"mathvariant":871},[66,9596,1194],{"mathvariant":871},[66,9598,890],{"mathvariant":871},[143,9600,1085],{},[147,9602,8716],{"stretchy":1079},[143,9604,8719],{},[147,9606,8722],{"stretchy":1079},[147,9608,566],{},[782,9610,9611,9621],{},[63,9612,9613,9615,9617,9619],{},[66,9614,2567],{"mathvariant":871},[66,9616,10],{"mathvariant":871},[66,9618,1194],{"mathvariant":871},[66,9620,890],{"mathvariant":871},[143,9622,145],{},[147,9624,8716],{"stretchy":1079},[143,9626,8719],{},[147,9628,8722],{"stretchy":1079},[70,9630,9631],{"encoding":72},"\\mathrm{vptr}_1[2..5] = \\mathrm{vptr}_2[2..5]",[13,9633,9635,9702],{"className":9634,"ariaHidden":77},[76],[13,9636,9638,9641,9684,9687,9690,9693,9696,9699],{"className":9637},[81],[13,9639],{"className":9640,"style":6163},[85],[13,9642,9644,9650],{"className":9643},[90],[13,9645,9647],{"className":9646},[90],[13,9648,8744],{"className":9649},[90,922],[13,9651,9653],{"className":9652},[739],[13,9654,9656,9676],{"className":9655},[188,189],[13,9657,9659,9673],{"className":9658},[193],[13,9660,9662],{"className":9661,"style":8757},[197],[13,9663,9664,9667],{"style":8760},[13,9665],{"className":9666,"style":755},[205],[13,9668,9670],{"className":9669},[210,211,212,213],[13,9671,1085],{"className":9672},[90,213],[13,9674,250],{"className":9675},[249],[13,9677,9679],{"className":9678},[193],[13,9680,9682],{"className":9681,"style":8779},[197],[13,9683],{},[13,9685,8716],{"className":9686},[180],[13,9688,8719],{"className":9689},[90],[13,9691,8722],{"className":9692},[263],[13,9694],{"className":9695,"style":268},[267],[13,9697,566],{"className":9698},[272],[13,9700],{"className":9701,"style":268},[267],[13,9703,9705,9708,9751,9754,9757],{"className":9704},[81],[13,9706],{"className":9707,"style":6163},[85],[13,9709,9711,9717],{"className":9710},[90],[13,9712,9714],{"className":9713},[90],[13,9715,8744],{"className":9716},[90,922],[13,9718,9720],{"className":9719},[739],[13,9721,9723,9743],{"className":9722},[188,189],[13,9724,9726,9740],{"className":9725},[193],[13,9727,9729],{"className":9728,"style":8757},[197],[13,9730,9731,9734],{"style":8760},[13,9732],{"className":9733,"style":755},[205],[13,9735,9737],{"className":9736},[210,211,212,213],[13,9738,145],{"className":9739},[90,213],[13,9741,250],{"className":9742},[249],[13,9744,9746],{"className":9745},[193],[13,9747,9749],{"className":9748,"style":8779},[197],[13,9750],{},[13,9752,8716],{"className":9753},[180],[13,9755,8719],{"className":9756},[90],[13,9758,8722],{"className":9759},[263],"), ",[13,9762,9764,9785],{"className":9763},[50],[13,9765,9767],{"className":9766},[54],[56,9768,9769],{"xmlns":58},[60,9770,9771,9783],{},[63,9772,9773],{},[782,9774,9775,9777],{},[66,9776,3262],{},[63,9778,9779,9781],{},[143,9780,1016],{},[66,9782,68],{},[70,9784,8631],{"encoding":72},[13,9786,9788],{"className":9787,"ariaHidden":77},[76],[13,9789,9791,9794],{"className":9790},[81],[13,9792],{"className":9793,"style":938},[85],[13,9795,9797,9800],{"className":9796},[90],[13,9798,3262],{"className":9799,"style":4259},[90,91],[13,9801,9803],{"className":9802},[739],[13,9804,9806,9832],{"className":9805},[188,189],[13,9807,9809,9829],{"className":9808},[193],[13,9810,9812],{"className":9811,"style":828},[197],[13,9813,9814,9817],{"style":4274},[13,9815],{"className":9816,"style":755},[205],[13,9818,9820],{"className":9819},[210,211,212,213],[13,9821,9823,9826],{"className":9822},[90,213],[13,9824,1016],{"className":9825},[90,213],[13,9827,68],{"className":9828},[90,91,213],[13,9830,250],{"className":9831},[249],[13,9833,9835],{"className":9834},[193],[13,9836,9838],{"className":9837,"style":853},[197],[13,9839],{}," is exactly equal to ",[13,9842,9844,9865],{"className":9843},[50],[13,9845,9847],{"className":9846},[54],[56,9848,9849],{"xmlns":58},[60,9850,9851,9863],{},[63,9852,9853],{},[782,9854,9855,9857],{},[66,9856,3262],{},[63,9858,9859,9861],{},[143,9860,1085],{},[66,9862,68],{},[70,9864,9178],{"encoding":72},[13,9866,9868],{"className":9867,"ariaHidden":77},[76],[13,9869,9871,9874],{"className":9870},[81],[13,9872],{"className":9873,"style":938},[85],[13,9875,9877,9880],{"className":9876},[90],[13,9878,3262],{"className":9879,"style":4259},[90,91],[13,9881,9883],{"className":9882},[739],[13,9884,9886,9912],{"className":9885},[188,189],[13,9887,9889,9909],{"className":9888},[193],[13,9890,9892],{"className":9891,"style":828},[197],[13,9893,9894,9897],{"style":4274},[13,9895],{"className":9896,"style":755},[205],[13,9898,9900],{"className":9899},[210,211,212,213],[13,9901,9903,9906],{"className":9902},[90,213],[13,9904,1085],{"className":9905},[90,213],[13,9907,68],{"className":9908},[90,91,213],[13,9910,250],{"className":9911},[249],[13,9913,9915],{"className":9914},[193],[13,9916,9918],{"className":9917,"style":853},[197],[13,9919],{},". When Skia processes this path in GrStyledShape::simplifyStroke, the identical X coordinates force the stroke to simplify into a perfectly straight, vertical line. This allows us to feed ",[13,9922,9924,9945],{"className":9923},[50],[13,9925,9927],{"className":9926},[54],[56,9928,9929],{"xmlns":58},[60,9930,9931,9943],{},[63,9932,9933],{},[782,9934,9935,9937],{},[66,9936,3262],{},[63,9938,9939,9941],{},[143,9940,1016],{},[66,9942,68],{},[70,9944,8631],{"encoding":72},[13,9946,9948],{"className":9947,"ariaHidden":77},[76],[13,9949,9951,9954],{"className":9950},[81],[13,9952],{"className":9953,"style":938},[85],[13,9955,9957,9960],{"className":9956},[90],[13,9958,3262],{"className":9959,"style":4259},[90,91],[13,9961,9963],{"className":9962},[739],[13,9964,9966,9992],{"className":9965},[188,189],[13,9967,9969,9989],{"className":9968},[193],[13,9970,9972],{"className":9971,"style":828},[197],[13,9973,9974,9977],{"style":4274},[13,9975],{"className":9976,"style":755},[205],[13,9978,9980],{"className":9979},[210,211,212,213],[13,9981,9983,9986],{"className":9982},[90,213],[13,9984,1016],{"className":9985},[90,213],[13,9987,68],{"className":9988},[90,91,213],[13,9990,250],{"className":9991},[249],[13,9993,9995],{"className":9994},[193],[13,9996,9998],{"className":9997,"style":853},[197],[13,9999],{}," directly into the 1D zoom search ladder described above to resolve the middle bytes.",[10,10002,10003,10004,5739],{},"However, the recovered middle bytes only pin the pointer to a 64 KiB window, leaving 16 possible 4 KiB pages. To resolve this ambiguity, we look at the companion coordinate ",[13,10005,10007,10028],{"className":10006},[50],[13,10008,10010],{"className":10009},[54],[56,10011,10012],{"xmlns":58},[60,10013,10014,10026],{},[63,10015,10016],{},[782,10017,10018,10020],{},[66,10019,3262],{},[63,10021,10022,10024],{},[143,10023,1016],{},[66,10025,107],{},[70,10027,8900],{"encoding":72},[13,10029,10031],{"className":10030,"ariaHidden":77},[76],[13,10032,10034,10037],{"className":10033},[81],[13,10035],{"className":10036,"style":8910},[85],[13,10038,10040,10043],{"className":10039},[90],[13,10041,3262],{"className":10042,"style":4259},[90,91],[13,10044,10046],{"className":10045},[739],[13,10047,10049,10075],{"className":10048},[188,189],[13,10050,10052,10072],{"className":10051},[193],[13,10053,10055],{"className":10054,"style":828},[197],[13,10056,10057,10060],{"style":4274},[13,10058],{"className":10059,"style":755},[205],[13,10061,10063],{"className":10062},[210,211,212,213],[13,10064,10066,10069],{"className":10065},[90,213],[13,10067,1016],{"className":10068},[90,213],[13,10070,107],{"className":10071,"style":123},[90,91,213],[13,10073,250],{"className":10074},[249],[13,10076,10078],{"className":10077},[193],[13,10079,10081],{"className":10080,"style":8955},[197],[13,10082],{},[10,10084,10085,10086,2329,10166,10261,10262,10341],{},"In x86_64 user space, canonical pointers only use the low 48 bits, meaning the upper two bytes of ",[13,10087,10089,10114],{"className":10088},[50],[13,10090,10092],{"className":10091},[54],[56,10093,10094],{"xmlns":58},[60,10095,10096,10112],{},[63,10097,10098],{},[782,10099,10100,10110],{},[63,10101,10102,10104,10106,10108],{},[66,10103,2567],{"mathvariant":871},[66,10105,10],{"mathvariant":871},[66,10107,1194],{"mathvariant":871},[66,10109,890],{"mathvariant":871},[143,10111,1085],{},[70,10113,8820],{"encoding":72},[13,10115,10117],{"className":10116,"ariaHidden":77},[76],[13,10118,10120,10123],{"className":10119},[81],[13,10121],{"className":10122,"style":8830},[85],[13,10124,10126,10132],{"className":10125},[90],[13,10127,10129],{"className":10128},[90],[13,10130,8744],{"className":10131},[90,922],[13,10133,10135],{"className":10134},[739],[13,10136,10138,10158],{"className":10137},[188,189],[13,10139,10141,10155],{"className":10140},[193],[13,10142,10144],{"className":10143,"style":8757},[197],[13,10145,10146,10149],{"style":8760},[13,10147],{"className":10148,"style":755},[205],[13,10150,10152],{"className":10151},[210,211,212,213],[13,10153,1085],{"className":10154},[90,213],[13,10156,250],{"className":10157},[249],[13,10159,10161],{"className":10160},[193],[13,10162,10164],{"className":10163,"style":8779},[197],[13,10165],{},[13,10167,10169,10200],{"className":10168},[50],[13,10170,10172],{"className":10171},[54],[56,10173,10174],{"xmlns":58},[60,10175,10176,10198],{},[63,10177,10178,10192,10194,10196],{},[782,10179,10180,10190],{},[63,10181,10182,10184,10186,10188],{},[66,10183,2567],{"mathvariant":871},[66,10185,10],{"mathvariant":871},[66,10187,1194],{"mathvariant":871},[66,10189,890],{"mathvariant":871},[143,10191,1085],{},[147,10193,8716],{"stretchy":1079},[143,10195,8988],{},[147,10197,8722],{"stretchy":1079},[70,10199,8993],{"encoding":72},[13,10201,10203],{"className":10202,"ariaHidden":77},[76],[13,10204,10206,10209,10252,10255,10258],{"className":10205},[81],[13,10207],{"className":10208,"style":6163},[85],[13,10210,10212,10218],{"className":10211},[90],[13,10213,10215],{"className":10214},[90],[13,10216,8744],{"className":10217},[90,922],[13,10219,10221],{"className":10220},[739],[13,10222,10224,10244],{"className":10223},[188,189],[13,10225,10227,10241],{"className":10226},[193],[13,10228,10230],{"className":10229,"style":8757},[197],[13,10231,10232,10235],{"style":8760},[13,10233],{"className":10234,"style":755},[205],[13,10236,10238],{"className":10237},[210,211,212,213],[13,10239,1085],{"className":10240},[90,213],[13,10242,250],{"className":10243},[249],[13,10245,10247],{"className":10246},[193],[13,10248,10250],{"className":10249,"style":8779},[197],[13,10251],{},[13,10253,8716],{"className":10254},[180],[13,10256,8988],{"className":10257},[90],[13,10259,8722],{"className":10260},[263],") are always zero. In little-endian memory, ",[13,10263,10265,10286],{"className":10264},[50],[13,10266,10268],{"className":10267},[54],[56,10269,10270],{"xmlns":58},[60,10271,10272,10284],{},[63,10273,10274],{},[782,10275,10276,10278],{},[66,10277,3262],{},[63,10279,10280,10282],{},[143,10281,1016],{},[66,10283,107],{},[70,10285,8900],{"encoding":72},[13,10287,10289],{"className":10288,"ariaHidden":77},[76],[13,10290,10292,10295],{"className":10291},[81],[13,10293],{"className":10294,"style":8910},[85],[13,10296,10298,10301],{"className":10297},[90],[13,10299,3262],{"className":10300,"style":4259},[90,91],[13,10302,10304],{"className":10303},[739],[13,10305,10307,10333],{"className":10306},[188,189],[13,10308,10310,10330],{"className":10309},[193],[13,10311,10313],{"className":10312,"style":828},[197],[13,10314,10315,10318],{"style":4274},[13,10316],{"className":10317,"style":755},[205],[13,10319,10321],{"className":10320},[210,211,212,213],[13,10322,10324,10327],{"className":10323},[90,213],[13,10325,1016],{"className":10326},[90,213],[13,10328,107],{"className":10329,"style":123},[90,91,213],[13,10331,250],{"className":10332},[249],[13,10334,10336],{"className":10335},[193],[13,10337,10339],{"className":10338,"style":8955},[197],[13,10340],{}," is read as:",[13,10343,10345],{"className":10344},[989],[13,10346,10348,10583],{"className":10347},[50],[13,10349,10351],{"className":10350},[54],[56,10352,10353],{"xmlns":58,"display":998},[60,10354,10355,10580],{},[1002,10356,10357,10495],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},[1008,10358,10359,10373],{},[1011,10360,10361],{},[1014,10362,10363],{"scriptlevel":1016,"displaystyle":77},[782,10364,10365,10367],{},[66,10366,3262],{},[63,10368,10369,10371],{},[143,10370,1016],{},[66,10372,107],{},[1011,10374,10375],{},[1014,10376,10377],{"scriptlevel":1016,"displaystyle":77},[63,10378,10379,10381,10383,10385,10399,10401,10403,10405,10407,10410,10412,10414,10416,10430,10432,10434,10436,10438,10440,10442,10444,10446,10460,10462,10465,10467,10469,10471,10473,10475,10489,10491,10493],{},[63,10380],{},[147,10382,566],{},[147,10384,539],{"stretchy":1079},[782,10386,10387,10397],{},[63,10388,10389,10391,10393,10395],{},[66,10390,2567],{"mathvariant":871},[66,10392,10],{"mathvariant":871},[66,10394,1194],{"mathvariant":871},[66,10396,890],{"mathvariant":871},[143,10398,145],{},[147,10400,8716],{"stretchy":1079},[143,10402,1085],{},[147,10404,8722],{"stretchy":1079},[147,10406,1088],{},[143,10408,10409],{},"24",[147,10411,440],{"stretchy":1079},[147,10413,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[147,10415,539],{"stretchy":1079},[782,10417,10418,10428],{},[63,10419,10420,10422,10424,10426],{},[66,10421,2567],{"mathvariant":871},[66,10423,10],{"mathvariant":871},[66,10425,1194],{"mathvariant":871},[66,10427,890],{"mathvariant":871},[143,10429,145],{},[147,10431,8716],{"stretchy":1079},[143,10433,1016],{},[147,10435,8722],{"stretchy":1079},[147,10437,1088],{},[143,10439,790],{},[147,10441,440],{"stretchy":1079},[147,10443,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[147,10445,539],{"stretchy":1079},[782,10447,10448,10458],{},[63,10449,10450,10452,10454,10456],{},[66,10451,2567],{"mathvariant":871},[66,10453,10],{"mathvariant":871},[66,10455,1194],{"mathvariant":871},[66,10457,890],{"mathvariant":871},[143,10459,1085],{},[147,10461,8716],{"stretchy":1079},[143,10463,10464],{},"7",[147,10466,8722],{"stretchy":1079},[147,10468,1088],{},[143,10470,3241],{},[147,10472,440],{"stretchy":1079},[147,10474,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[782,10476,10477,10487],{},[63,10478,10479,10481,10483,10485],{},[66,10480,2567],{"mathvariant":871},[66,10482,10],{"mathvariant":871},[66,10484,1194],{"mathvariant":871},[66,10486,890],{"mathvariant":871},[143,10488,1085],{},[147,10490,8716],{"stretchy":1079},[143,10492,8379],{},[147,10494,8722],{"stretchy":1079},[1008,10496,10497,10503],{},[1011,10498,10499],{},[1014,10500,10501],{"scriptlevel":1016,"displaystyle":77},[63,10502],{},[1011,10504,10505],{},[1014,10506,10507],{"scriptlevel":1016,"displaystyle":77},[63,10508,10509,10511,10513,10515,10529,10531,10533,10535,10537,10539,10541,10543,10545,10559,10561,10563,10565,10567,10569,10571,10573],{},[63,10510],{},[147,10512,566],{},[147,10514,539],{"stretchy":1079},[782,10516,10517,10527],{},[63,10518,10519,10521,10523,10525],{},[66,10520,2567],{"mathvariant":871},[66,10522,10],{"mathvariant":871},[66,10524,1194],{"mathvariant":871},[66,10526,890],{"mathvariant":871},[143,10528,145],{},[147,10530,8716],{"stretchy":1079},[143,10532,1085],{},[147,10534,8722],{"stretchy":1079},[147,10536,1088],{},[143,10538,10409],{},[147,10540,440],{"stretchy":1079},[147,10542,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[147,10544,539],{"stretchy":1079},[782,10546,10547,10557],{},[63,10548,10549,10551,10553,10555],{},[66,10550,2567],{"mathvariant":871},[66,10552,10],{"mathvariant":871},[66,10554,1194],{"mathvariant":871},[66,10556,890],{"mathvariant":871},[143,10558,145],{},[147,10560,8716],{"stretchy":1079},[143,10562,1016],{},[147,10564,8722],{"stretchy":1079},[147,10566,1088],{},[143,10568,790],{},[147,10570,440],{"stretchy":1079},[147,10572,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[782,10574,10575,10578],{},[785,10576,10577],{},"0000",[143,10579,790],{},[70,10581,10582],{"encoding":72},"\\begin{aligned}\nP_{0y} &= (\\mathrm{vptr}_2[1] \\ll 24) \\mathbin{|} (\\mathrm{vptr}_2[0] \\ll 16) \\mathbin{|} (\\mathrm{vptr}_1[7] \\ll 8) \\mathbin{|} \\mathrm{vptr}_1[6] \\\\\n&= (\\mathrm{vptr}_2[1] \\ll 24) \\mathbin{|} (\\mathrm{vptr}_2[0] \\ll 16) \\mathbin{|} \\text{0000}_{16}\n\\end{aligned}",[13,10584,10586],{"className":10585,"ariaHidden":77},[76],[13,10587,10589,10593],{"className":10588},[81],[13,10590],{"className":10591,"style":10592},[85],"height:2.7em;vertical-align:-1.1em;",[13,10594,10596],{"className":10595},[90],[13,10597,10599,10688],{"className":10598},[1002],[13,10600,10602],{"className":10601},[1363],[13,10603,10605,10679],{"className":10604},[188,189],[13,10606,10608,10676],{"className":10607},[193],[13,10609,10612,10667],{"className":10610,"style":10611},[197],"height:1.6em;",[13,10613,10615,10618],{"style":10614},"top:-3.76em;",[13,10616],{"className":10617,"style":206},[205],[13,10619,10621],{"className":10620},[90],[13,10622,10624,10627],{"className":10623},[90],[13,10625,3262],{"className":10626,"style":4259},[90,91],[13,10628,10630],{"className":10629},[739],[13,10631,10633,10659],{"className":10632},[188,189],[13,10634,10636,10656],{"className":10635},[193],[13,10637,10639],{"className":10638,"style":828},[197],[13,10640,10641,10644],{"style":4274},[13,10642],{"className":10643,"style":755},[205],[13,10645,10647],{"className":10646},[210,211,212,213],[13,10648,10650,10653],{"className":10649},[90,213],[13,10651,1016],{"className":10652},[90,213],[13,10654,107],{"className":10655,"style":123},[90,91,213],[13,10657,250],{"className":10658},[249],[13,10660,10662],{"className":10661},[193],[13,10663,10665],{"className":10664,"style":8955},[197],[13,10666],{},[13,10668,10670,10673],{"style":10669},"top:-2.26em;",[13,10671],{"className":10672,"style":206},[205],[13,10674],{"className":10675},[90],[13,10677,250],{"className":10678},[249],[13,10680,10682],{"className":10681},[193],[13,10683,10686],{"className":10684,"style":10685},[197],"height:1.1em;",[13,10687],{},[13,10689,10691],{"className":10690},[1456],[13,10692,10694,11251],{"className":10693},[188,189],[13,10695,10697,11248],{"className":10696},[193],[13,10698,10700,11018],{"className":10699,"style":10611},[197],[13,10701,10702,10705],{"style":10614},[13,10703],{"className":10704,"style":206},[205],[13,10706,10708,10711,10714,10717,10720,10723,10766,10769,10772,10775,10778,10781,10784,10787,10790,10793,10799,10802,10805,10848,10851,10854,10857,10860,10863,10866,10869,10872,10875,10881,10884,10887,10930,10933,10936,10939,10942,10945,10948,10951,10954,10957,10963,10966,11009,11012,11015],{"className":10707},[90],[13,10709],{"className":10710},[90],[13,10712],{"className":10713,"style":268},[267],[13,10715,566],{"className":10716},[272],[13,10718],{"className":10719,"style":268},[267],[13,10721,539],{"className":10722},[180],[13,10724,10726,10732],{"className":10725},[90],[13,10727,10729],{"className":10728},[90],[13,10730,8744],{"className":10731},[90,922],[13,10733,10735],{"className":10734},[739],[13,10736,10738,10758],{"className":10737},[188,189],[13,10739,10741,10755],{"className":10740},[193],[13,10742,10744],{"className":10743,"style":8757},[197],[13,10745,10746,10749],{"style":8760},[13,10747],{"className":10748,"style":755},[205],[13,10750,10752],{"className":10751},[210,211,212,213],[13,10753,145],{"className":10754},[90,213],[13,10756,250],{"className":10757},[249],[13,10759,10761],{"className":10760},[193],[13,10762,10764],{"className":10763,"style":8779},[197],[13,10765],{},[13,10767,8716],{"className":10768},[180],[13,10770,1085],{"className":10771},[90],[13,10773,8722],{"className":10774},[263],[13,10776],{"className":10777,"style":268},[267],[13,10779,1088],{"className":10780},[272],[13,10782],{"className":10783,"style":268},[267],[13,10785,10409],{"className":10786},[90],[13,10788,440],{"className":10789},[263],[13,10791],{"className":10792,"style":351},[267],[13,10794,10796],{"className":10795},[355],[13,10797,7285],{"className":10798},[90],[13,10800],{"className":10801,"style":351},[267],[13,10803,539],{"className":10804},[180],[13,10806,10808,10814],{"className":10807},[90],[13,10809,10811],{"className":10810},[90],[13,10812,8744],{"className":10813},[90,922],[13,10815,10817],{"className":10816},[739],[13,10818,10820,10840],{"className":10819},[188,189],[13,10821,10823,10837],{"className":10822},[193],[13,10824,10826],{"className":10825,"style":8757},[197],[13,10827,10828,10831],{"style":8760},[13,10829],{"className":10830,"style":755},[205],[13,10832,10834],{"className":10833},[210,211,212,213],[13,10835,145],{"className":10836},[90,213],[13,10838,250],{"className":10839},[249],[13,10841,10843],{"className":10842},[193],[13,10844,10846],{"className":10845,"style":8779},[197],[13,10847],{},[13,10849,8716],{"className":10850},[180],[13,10852,1016],{"className":10853},[90],[13,10855,8722],{"className":10856},[263],[13,10858],{"className":10859,"style":268},[267],[13,10861,1088],{"className":10862},[272],[13,10864],{"className":10865,"style":268},[267],[13,10867,790],{"className":10868},[90],[13,10870,440],{"className":10871},[263],[13,10873],{"className":10874,"style":351},[267],[13,10876,10878],{"className":10877},[355],[13,10879,7285],{"className":10880},[90],[13,10882],{"className":10883,"style":351},[267],[13,10885,539],{"className":10886},[180],[13,10888,10890,10896],{"className":10889},[90],[13,10891,10893],{"className":10892},[90],[13,10894,8744],{"className":10895},[90,922],[13,10897,10899],{"className":10898},[739],[13,10900,10902,10922],{"className":10901},[188,189],[13,10903,10905,10919],{"className":10904},[193],[13,10906,10908],{"className":10907,"style":8757},[197],[13,10909,10910,10913],{"style":8760},[13,10911],{"className":10912,"style":755},[205],[13,10914,10916],{"className":10915},[210,211,212,213],[13,10917,1085],{"className":10918},[90,213],[13,10920,250],{"className":10921},[249],[13,10923,10925],{"className":10924},[193],[13,10926,10928],{"className":10927,"style":8779},[197],[13,10929],{},[13,10931,8716],{"className":10932},[180],[13,10934,10464],{"className":10935},[90],[13,10937,8722],{"className":10938},[263],[13,10940],{"className":10941,"style":268},[267],[13,10943,1088],{"className":10944},[272],[13,10946],{"className":10947,"style":268},[267],[13,10949,3241],{"className":10950},[90],[13,10952,440],{"className":10953},[263],[13,10955],{"className":10956,"style":351},[267],[13,10958,10960],{"className":10959},[355],[13,10961,7285],{"className":10962},[90],[13,10964],{"className":10965,"style":351},[267],[13,10967,10969,10975],{"className":10968},[90],[13,10970,10972],{"className":10971},[90],[13,10973,8744],{"className":10974},[90,922],[13,10976,10978],{"className":10977},[739],[13,10979,10981,11001],{"className":10980},[188,189],[13,10982,10984,10998],{"className":10983},[193],[13,10985,10987],{"className":10986,"style":8757},[197],[13,10988,10989,10992],{"style":8760},[13,10990],{"className":10991,"style":755},[205],[13,10993,10995],{"className":10994},[210,211,212,213],[13,10996,1085],{"className":10997},[90,213],[13,10999,250],{"className":11000},[249],[13,11002,11004],{"className":11003},[193],[13,11005,11007],{"className":11006,"style":8779},[197],[13,11008],{},[13,11010,8716],{"className":11011},[180],[13,11013,8379],{"className":11014},[90],[13,11016,8722],{"className":11017},[263],[13,11019,11020,11023],{"style":10669},[13,11021],{"className":11022,"style":206},[205],[13,11024,11026,11029,11032,11035,11038,11041,11084,11087,11090,11093,11096,11099,11102,11105,11108,11111,11117,11120,11123,11166,11169,11172,11175,11178,11181,11184,11187,11190,11193,11199,11202],{"className":11025},[90],[13,11027],{"className":11028},[90],[13,11030],{"className":11031,"style":268},[267],[13,11033,566],{"className":11034},[272],[13,11036],{"className":11037,"style":268},[267],[13,11039,539],{"className":11040},[180],[13,11042,11044,11050],{"className":11043},[90],[13,11045,11047],{"className":11046},[90],[13,11048,8744],{"className":11049},[90,922],[13,11051,11053],{"className":11052},[739],[13,11054,11056,11076],{"className":11055},[188,189],[13,11057,11059,11073],{"className":11058},[193],[13,11060,11062],{"className":11061,"style":8757},[197],[13,11063,11064,11067],{"style":8760},[13,11065],{"className":11066,"style":755},[205],[13,11068,11070],{"className":11069},[210,211,212,213],[13,11071,145],{"className":11072},[90,213],[13,11074,250],{"className":11075},[249],[13,11077,11079],{"className":11078},[193],[13,11080,11082],{"className":11081,"style":8779},[197],[13,11083],{},[13,11085,8716],{"className":11086},[180],[13,11088,1085],{"className":11089},[90],[13,11091,8722],{"className":11092},[263],[13,11094],{"className":11095,"style":268},[267],[13,11097,1088],{"className":11098},[272],[13,11100],{"className":11101,"style":268},[267],[13,11103,10409],{"className":11104},[90],[13,11106,440],{"className":11107},[263],[13,11109],{"className":11110,"style":351},[267],[13,11112,11114],{"className":11113},[355],[13,11115,7285],{"className":11116},[90],[13,11118],{"className":11119,"style":351},[267],[13,11121,539],{"className":11122},[180],[13,11124,11126,11132],{"className":11125},[90],[13,11127,11129],{"className":11128},[90],[13,11130,8744],{"className":11131},[90,922],[13,11133,11135],{"className":11134},[739],[13,11136,11138,11158],{"className":11137},[188,189],[13,11139,11141,11155],{"className":11140},[193],[13,11142,11144],{"className":11143,"style":8757},[197],[13,11145,11146,11149],{"style":8760},[13,11147],{"className":11148,"style":755},[205],[13,11150,11152],{"className":11151},[210,211,212,213],[13,11153,145],{"className":11154},[90,213],[13,11156,250],{"className":11157},[249],[13,11159,11161],{"className":11160},[193],[13,11162,11164],{"className":11163,"style":8779},[197],[13,11165],{},[13,11167,8716],{"className":11168},[180],[13,11170,1016],{"className":11171},[90],[13,11173,8722],{"className":11174},[263],[13,11176],{"className":11177,"style":268},[267],[13,11179,1088],{"className":11180},[272],[13,11182],{"className":11183,"style":268},[267],[13,11185,790],{"className":11186},[90],[13,11188,440],{"className":11189},[263],[13,11191],{"className":11192,"style":351},[267],[13,11194,11196],{"className":11195},[355],[13,11197,7285],{"className":11198},[90],[13,11200],{"className":11201,"style":351},[267],[13,11203,11205,11211],{"className":11204},[90],[13,11206,11208],{"className":11207},[90,687],[13,11209,10577],{"className":11210},[90],[13,11212,11214],{"className":11213},[739],[13,11215,11217,11240],{"className":11216},[188,189],[13,11218,11220,11237],{"className":11219},[193],[13,11221,11223],{"className":11222,"style":828},[197],[13,11224,11225,11228],{"style":831},[13,11226],{"className":11227,"style":755},[205],[13,11229,11231],{"className":11230},[210,211,212,213],[13,11232,11234],{"className":11233},[90,213],[13,11235,790],{"className":11236},[90,213],[13,11238,250],{"className":11239},[249],[13,11241,11243],{"className":11242},[193],[13,11244,11246],{"className":11245,"style":853},[197],[13,11247],{},[13,11249,250],{"className":11250},[249],[13,11252,11254],{"className":11253},[193],[13,11255,11257],{"className":11256,"style":10685},[197],[13,11258],{},[10,11260,11261,11262,11357,11358,11438,11439,5739],{},"When this 32-bit integer is parsed as a float32, its sign and exponent bits are entirely determined by ",[13,11263,11265,11296],{"className":11264},[50],[13,11266,11268],{"className":11267},[54],[56,11269,11270],{"xmlns":58},[60,11271,11272,11294],{},[63,11273,11274,11288,11290,11292],{},[782,11275,11276,11286],{},[63,11277,11278,11280,11282,11284],{},[66,11279,2567],{"mathvariant":871},[66,11281,10],{"mathvariant":871},[66,11283,1194],{"mathvariant":871},[66,11285,890],{"mathvariant":871},[143,11287,145],{},[147,11289,8716],{"stretchy":1079},[143,11291,9085],{},[147,11293,8722],{"stretchy":1079},[70,11295,9090],{"encoding":72},[13,11297,11299],{"className":11298,"ariaHidden":77},[76],[13,11300,11302,11305,11348,11351,11354],{"className":11301},[81],[13,11303],{"className":11304,"style":6163},[85],[13,11306,11308,11314],{"className":11307},[90],[13,11309,11311],{"className":11310},[90],[13,11312,8744],{"className":11313},[90,922],[13,11315,11317],{"className":11316},[739],[13,11318,11320,11340],{"className":11319},[188,189],[13,11321,11323,11337],{"className":11322},[193],[13,11324,11326],{"className":11325,"style":8757},[197],[13,11327,11328,11331],{"style":8760},[13,11329],{"className":11330,"style":755},[205],[13,11332,11334],{"className":11333},[210,211,212,213],[13,11335,145],{"className":11336},[90,213],[13,11338,250],{"className":11339},[249],[13,11341,11343],{"className":11342},[193],[13,11344,11346],{"className":11345,"style":8779},[197],[13,11347],{},[13,11349,8716],{"className":11350},[180],[13,11352,9085],{"className":11353},[90],[13,11355,8722],{"className":11356},[263],", which contains the randomized page offset and page bits of the secondary vtable. Each of the 16 candidate pages produces a different ",[13,11359,11361,11386],{"className":11360},[50],[13,11362,11364],{"className":11363},[54],[56,11365,11366],{"xmlns":58},[60,11367,11368,11384],{},[63,11369,11370],{},[782,11371,11372,11382],{},[63,11373,11374,11376,11378,11380],{},[66,11375,2567],{"mathvariant":871},[66,11377,10],{"mathvariant":871},[66,11379,1194],{"mathvariant":871},[66,11381,890],{"mathvariant":871},[143,11383,145],{},[70,11385,9358],{"encoding":72},[13,11387,11389],{"className":11388,"ariaHidden":77},[76],[13,11390,11392,11395],{"className":11391},[81],[13,11393],{"className":11394,"style":8830},[85],[13,11396,11398,11404],{"className":11397},[90],[13,11399,11401],{"className":11400},[90],[13,11402,8744],{"className":11403},[90,922],[13,11405,11407],{"className":11406},[739],[13,11408,11410,11430],{"className":11409},[188,189],[13,11411,11413,11427],{"className":11412},[193],[13,11414,11416],{"className":11415,"style":8757},[197],[13,11417,11418,11421],{"style":8760},[13,11419],{"className":11420,"style":755},[205],[13,11422,11424],{"className":11423},[210,211,212,213],[13,11425,145],{"className":11426},[90,213],[13,11428,250],{"className":11429},[249],[13,11431,11433],{"className":11432},[193],[13,11434,11436],{"className":11435,"style":8779},[197],[13,11437],{}," value, mapping to a unique (exponent, sign) pair for ",[13,11440,11442,11463],{"className":11441},[50],[13,11443,11445],{"className":11444},[54],[56,11446,11447],{"xmlns":58},[60,11448,11449,11461],{},[63,11450,11451],{},[782,11452,11453,11455],{},[66,11454,3262],{},[63,11456,11457,11459],{},[143,11458,1016],{},[66,11460,107],{},[70,11462,8900],{"encoding":72},[13,11464,11466],{"className":11465,"ariaHidden":77},[76],[13,11467,11469,11472],{"className":11468},[81],[13,11470],{"className":11471,"style":8910},[85],[13,11473,11475,11478],{"className":11474},[90],[13,11476,3262],{"className":11477,"style":4259},[90,91],[13,11479,11481],{"className":11480},[739],[13,11482,11484,11510],{"className":11483},[188,189],[13,11485,11487,11507],{"className":11486},[193],[13,11488,11490],{"className":11489,"style":828},[197],[13,11491,11492,11495],{"style":4274},[13,11493],{"className":11494,"style":755},[205],[13,11496,11498],{"className":11497},[210,211,212,213],[13,11499,11501,11504],{"className":11500},[90,213],[13,11502,1016],{"className":11503},[90,213],[13,11505,107],{"className":11506,"style":123},[90,91,213],[13,11508,250],{"className":11509},[249],[13,11511,11513],{"className":11512},[193],[13,11514,11516],{"className":11515,"style":8955},[197],[13,11517],{},[10,11519,11520,11521,11591,11592,11661,11662,11741],{},"Probing the canvas with different Y-scales ",[13,11522,11524,11542],{"className":11523},[50],[13,11525,11527],{"className":11526},[54],[56,11528,11529],{"xmlns":58},[60,11530,11531,11539],{},[63,11532,11533],{},[782,11534,11535,11537],{},[66,11536,3217],{},[66,11538,107],{},[70,11540,11541],{"encoding":72},"S_y",[13,11543,11545],{"className":11544,"ariaHidden":77},[76],[13,11546,11548,11551],{"className":11547},[81],[13,11549],{"className":11550,"style":8910},[85],[13,11552,11554,11557],{"className":11553},[90],[13,11555,3217],{"className":11556,"style":4198},[90,91],[13,11558,11560],{"className":11559},[739],[13,11561,11563,11583],{"className":11562},[188,189],[13,11564,11566,11580],{"className":11565},[193],[13,11567,11569],{"className":11568,"style":4153},[197],[13,11570,11571,11574],{"style":4213},[13,11572],{"className":11573,"style":755},[205],[13,11575,11577],{"className":11576},[210,211,212,213],[13,11578,107],{"className":11579,"style":123},[90,91,213],[13,11581,250],{"className":11582},[249],[13,11584,11586],{"className":11585},[193],[13,11587,11589],{"className":11588,"style":8955},[197],[13,11590],{}," will only render the line on-screen when ",[13,11593,11595,11612],{"className":11594},[50],[13,11596,11598],{"className":11597},[54],[56,11599,11600],{"xmlns":58},[60,11601,11602,11610],{},[63,11603,11604],{},[782,11605,11606,11608],{},[66,11607,3217],{},[66,11609,107],{},[70,11611,11541],{"encoding":72},[13,11613,11615],{"className":11614,"ariaHidden":77},[76],[13,11616,11618,11621],{"className":11617},[81],[13,11619],{"className":11620,"style":8910},[85],[13,11622,11624,11627],{"className":11623},[90],[13,11625,3217],{"className":11626,"style":4198},[90,91],[13,11628,11630],{"className":11629},[739],[13,11631,11633,11653],{"className":11632},[188,189],[13,11634,11636,11650],{"className":11635},[193],[13,11637,11639],{"className":11638,"style":4153},[197],[13,11640,11641,11644],{"style":4213},[13,11642],{"className":11643,"style":755},[205],[13,11645,11647],{"className":11646},[210,211,212,213],[13,11648,107],{"className":11649,"style":123},[90,91,213],[13,11651,250],{"className":11652},[249],[13,11654,11656],{"className":11655},[193],[13,11657,11659],{"className":11658,"style":8955},[197],[13,11660],{}," matches the true exponent of ",[13,11663,11665,11686],{"className":11664},[50],[13,11666,11668],{"className":11667},[54],[56,11669,11670],{"xmlns":58},[60,11671,11672,11684],{},[63,11673,11674],{},[782,11675,11676,11678],{},[66,11677,3262],{},[63,11679,11680,11682],{},[143,11681,1016],{},[66,11683,107],{},[70,11685,8900],{"encoding":72},[13,11687,11689],{"className":11688,"ariaHidden":77},[76],[13,11690,11692,11695],{"className":11691},[81],[13,11693],{"className":11694,"style":8910},[85],[13,11696,11698,11701],{"className":11697},[90],[13,11699,3262],{"className":11700,"style":4259},[90,91],[13,11702,11704],{"className":11703},[739],[13,11705,11707,11733],{"className":11706},[188,189],[13,11708,11710,11730],{"className":11709},[193],[13,11711,11713],{"className":11712,"style":828},[197],[13,11714,11715,11718],{"style":4274},[13,11716],{"className":11717,"style":755},[205],[13,11719,11721],{"className":11720},[210,211,212,213],[13,11722,11724,11727],{"className":11723},[90,213],[13,11725,1016],{"className":11726},[90,213],[13,11728,107],{"className":11729,"style":123},[90,91,213],[13,11731,250],{"className":11732},[249],[13,11734,11736],{"className":11735},[193],[13,11737,11739],{"className":11738,"style":8955},[197],[13,11740],{},", while the direction it shifts reveals the sign. This fingerprint uniquely identifies the correct page, resolving the ambiguity.",[10,11743,11744],{},"We can express this mapping mathematically. The loading address of chrome.so is aligned to a 4 KiB page boundary, meaning the lowest 12 bits of chrome_base are always zero. The page index k (0..15) within the 64 KiB window occupies bits 12..15 of chrome_base, making the low 16 bits of the load base equal to (k \u003C\u003C 12). Adding the static RVA offset of the secondary vtable (0x0faa7e00) gives:",[13,11746,11748],{"className":11747},[989],[13,11749,11751,11887],{"className":11750},[50],[13,11752,11754],{"className":11753},[54],[56,11755,11756],{"xmlns":58,"display":998},[60,11757,11758,11884],{},[1002,11759,11760,11826],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},[1008,11761,11762,11795],{},[1011,11763,11764],{},[1014,11765,11766],{"scriptlevel":1016,"displaystyle":77},[782,11767,11768,11778],{},[63,11769,11770,11772,11774,11776],{},[66,11771,2567],{"mathvariant":871},[66,11773,10],{"mathvariant":871},[66,11775,1194],{"mathvariant":871},[66,11777,890],{"mathvariant":871},[63,11779,11780,11782,11784],{},[143,11781,145],{},[147,11783,160],{"separator":77},[63,11785,11786,11788,11790,11793],{},[66,11787,1027],{"mathvariant":871},[66,11789,879],{"mathvariant":871},[66,11791,11792],{"mathvariant":871},"w",[143,11794,790],{},[1011,11796,11797],{},[1014,11798,11799],{"scriptlevel":1016,"displaystyle":77},[63,11800,11801,11803,11805,11807,11810,11812,11815,11817,11819],{},[63,11802],{},[147,11804,566],{},[147,11806,539],{"stretchy":1079},[66,11808,11809],{},"k",[147,11811,1088],{},[143,11813,11814],{},"12",[147,11816,440],{"stretchy":1079},[147,11818,780],{},[782,11820,11821,11824],{},[785,11822,11823],{},"7E00",[143,11825,790],{},[1008,11827,11828,11834],{},[1011,11829,11830],{},[1014,11831,11832],{"scriptlevel":1016,"displaystyle":77},[63,11833],{},[1011,11835,11836],{},[1014,11837,11838],{"scriptlevel":1016,"displaystyle":77},[63,11839,11840,11842,11844,11846,11848,11850,11852,11854,11856,11858,11865,11867,11869,11871,11873,11875,11877],{},[63,11841],{},[147,11843,566],{},[147,11845,539],{"fence":1079,"stretchy":77,"minsize":1080,"maxsize":1080},[147,11847,539],{"stretchy":1079},[66,11849,11809],{},[147,11851,780],{},[143,11853,10464],{},[147,11855,440],{"stretchy":1079},[147,11857,617],{"mathvariant":871,"lspace":1070,"rspace":1070},[782,11859,11860,11863],{},[785,11861,11862],{},"F",[143,11864,790],{},[147,11866,440],{"fence":1079,"stretchy":77,"minsize":1080,"maxsize":1080},[147,11868,1088],{},[143,11870,11814],{},[785,11872,3268],{},[147,11874,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[785,11876,3268],{},[782,11878,11879,11882],{},[785,11880,11881],{},"E00",[143,11883,790],{},[70,11885,11886],{"encoding":72},"\\begin{aligned}\n\\mathrm{vptr}_{2,\\mathrm{low16}} &= (k \\ll 12) + \\text{7E00}_{16} \\\\\n&= \\big((k + 7) \\mathbin{\\&} \\text{F}_{16}\\big) \\ll 12 \\ \\mathbin{|}\\ \\text{E00}_{16}\n\\end{aligned}",[13,11888,11890],{"className":11889,"ariaHidden":77},[76],[13,11891,11893,11897],{"className":11892},[81],[13,11894],{"className":11895,"style":11896},[85],"height:2.7302em;vertical-align:-1.1151em;",[13,11898,11900],{"className":11899},[90],[13,11901,11903,12004],{"className":11902},[1002],[13,11904,11906],{"className":11905},[1363],[13,11907,11909,11995],{"className":11908},[188,189],[13,11910,11912,11992],{"className":11911},[193],[13,11913,11916,11983],{"className":11914,"style":11915},[197],"height:1.6151em;",[13,11917,11919,11922],{"style":11918},"top:-3.7751em;",[13,11920],{"className":11921,"style":206},[205],[13,11923,11925],{"className":11924},[90],[13,11926,11928,11934],{"className":11927},[90],[13,11929,11931],{"className":11930},[90],[13,11932,8744],{"className":11933},[90,922],[13,11935,11937],{"className":11936},[739],[13,11938,11940,11974],{"className":11939},[188,189],[13,11941,11943,11971],{"className":11942},[193],[13,11944,11947],{"className":11945,"style":11946},[197],"height:0.242em;",[13,11948,11949,11952],{"style":8760},[13,11950],{"className":11951,"style":755},[205],[13,11953,11955],{"className":11954},[210,211,212,213],[13,11956,11958,11961,11964],{"className":11957},[90,213],[13,11959,145],{"className":11960},[90,213],[13,11962,160],{"className":11963},[311,213],[13,11965,11967],{"className":11966},[90,213],[13,11968,11970],{"className":11969},[90,922,213],"low16",[13,11972,250],{"className":11973},[249],[13,11975,11977],{"className":11976},[193],[13,11978,11981],{"className":11979,"style":11980},[197],"height:0.3802em;",[13,11982],{},[13,11984,11986,11989],{"style":11985},"top:-2.2449em;",[13,11987],{"className":11988,"style":206},[205],[13,11990],{"className":11991},[90],[13,11993,250],{"className":11994},[249],[13,11996,11998],{"className":11997},[193],[13,11999,12002],{"className":12000,"style":12001},[197],"height:1.1151em;",[13,12003],{},[13,12005,12007],{"className":12006},[1456],[13,12008,12010,12303],{"className":12009},[188,189],[13,12011,12013,12300],{"className":12012},[193],[13,12014,12016,12113],{"className":12015,"style":11915},[197],[13,12017,12018,12021],{"style":11918},[13,12019],{"className":12020,"style":206},[205],[13,12022,12024,12027,12030,12033,12036,12039,12043,12046,12049,12052,12055,12058,12061,12064,12067],{"className":12023},[90],[13,12025],{"className":12026},[90],[13,12028],{"className":12029,"style":268},[267],[13,12031,566],{"className":12032},[272],[13,12034],{"className":12035,"style":268},[267],[13,12037,539],{"className":12038},[180],[13,12040,11809],{"className":12041,"style":12042},[90,91],"margin-right:0.0315em;",[13,12044],{"className":12045,"style":268},[267],[13,12047,1088],{"className":12048},[272],[13,12050],{"className":12051,"style":268},[267],[13,12053,11814],{"className":12054},[90],[13,12056,440],{"className":12057},[263],[13,12059],{"className":12060,"style":351},[267],[13,12062,780],{"className":12063},[355],[13,12065],{"className":12066,"style":351},[267],[13,12068,12070,12076],{"className":12069},[90],[13,12071,12073],{"className":12072},[90,687],[13,12074,11823],{"className":12075},[90],[13,12077,12079],{"className":12078},[739],[13,12080,12082,12105],{"className":12081},[188,189],[13,12083,12085,12102],{"className":12084},[193],[13,12086,12088],{"className":12087,"style":828},[197],[13,12089,12090,12093],{"style":831},[13,12091],{"className":12092,"style":755},[205],[13,12094,12096],{"className":12095},[210,211,212,213],[13,12097,12099],{"className":12098},[90,213],[13,12100,790],{"className":12101},[90,213],[13,12103,250],{"className":12104},[249],[13,12106,12108],{"className":12107},[193],[13,12109,12111],{"className":12110,"style":853},[197],[13,12112],{},[13,12114,12115,12118],{"style":11985},[13,12116],{"className":12117,"style":206},[205],[13,12119,12121,12124,12127,12130,12133,12139,12142,12145,12148,12151,12154,12157,12160,12163,12169,12172,12218,12224,12227,12230,12233,12236,12239,12242,12248,12251,12254],{"className":12120},[90],[13,12122],{"className":12123},[90],[13,12125],{"className":12126,"style":268},[267],[13,12128,566],{"className":12129},[272],[13,12131],{"className":12132,"style":268},[267],[13,12134,12136],{"className":12135},[90],[13,12137,539],{"className":12138},[1520,1521],[13,12140,539],{"className":12141},[180],[13,12143,11809],{"className":12144,"style":12042},[90,91],[13,12146],{"className":12147,"style":351},[267],[13,12149,780],{"className":12150},[355],[13,12152],{"className":12153,"style":351},[267],[13,12155,10464],{"className":12156},[90],[13,12158,440],{"className":12159},[263],[13,12161],{"className":12162,"style":351},[267],[13,12164,12166],{"className":12165},[355],[13,12167,617],{"className":12168},[90],[13,12170],{"className":12171,"style":351},[267],[13,12173,12175,12181],{"className":12174},[90],[13,12176,12178],{"className":12177},[90,687],[13,12179,11862],{"className":12180},[90],[13,12182,12184],{"className":12183},[739],[13,12185,12187,12210],{"className":12186},[188,189],[13,12188,12190,12207],{"className":12189},[193],[13,12191,12193],{"className":12192,"style":828},[197],[13,12194,12195,12198],{"style":831},[13,12196],{"className":12197,"style":755},[205],[13,12199,12201],{"className":12200},[210,211,212,213],[13,12202,12204],{"className":12203},[90,213],[13,12205,790],{"className":12206},[90,213],[13,12208,250],{"className":12209},[249],[13,12211,12213],{"className":12212},[193],[13,12214,12216],{"className":12215,"style":853},[197],[13,12217],{},[13,12219,12221],{"className":12220},[90],[13,12222,440],{"className":12223},[1520,1521],[13,12225],{"className":12226,"style":268},[267],[13,12228,1088],{"className":12229},[272],[13,12231],{"className":12232,"style":268},[267],[13,12234,11814],{"className":12235},[90],[13,12237,3268],{"className":12238},[267],[13,12240],{"className":12241,"style":351},[267],[13,12243,12245],{"className":12244},[355],[13,12246,7285],{"className":12247},[90],[13,12249,3268],{"className":12250},[267],[13,12252],{"className":12253,"style":351},[267],[13,12255,12257,12263],{"className":12256},[90],[13,12258,12260],{"className":12259},[90,687],[13,12261,11881],{"className":12262},[90],[13,12264,12266],{"className":12265},[739],[13,12267,12269,12292],{"className":12268},[188,189],[13,12270,12272,12289],{"className":12271},[193],[13,12273,12275],{"className":12274,"style":828},[197],[13,12276,12277,12280],{"style":831},[13,12278],{"className":12279,"style":755},[205],[13,12281,12283],{"className":12282},[210,211,212,213],[13,12284,12286],{"className":12285},[90,213],[13,12287,790],{"className":12288},[90,213],[13,12290,250],{"className":12291},[249],[13,12293,12295],{"className":12294},[193],[13,12296,12298],{"className":12297,"style":853},[197],[13,12299],{},[13,12301,250],{"className":12302},[249],[13,12304,12306],{"className":12305},[193],[13,12307,12309],{"className":12308,"style":12001},[197],[13,12310],{},[10,12312,12313,12314,12448,12449,12615,12616,5739],{},"Let ",[13,12315,12317,12361],{"className":12316},[50],[13,12318,12320],{"className":12319},[54],[56,12321,12322],{"xmlns":58},[60,12323,12324,12358],{},[63,12325,12326,12329,12331,12333,12335,12337,12339,12341,12344,12354,12356],{},[66,12327,12328],{},"N",[147,12330,566],{},[147,12332,539],{"stretchy":1079},[66,12334,11809],{},[147,12336,780],{},[143,12338,10464],{},[147,12340,440],{"stretchy":1079},[785,12342,12343],{}," ",[147,12345,12346],{"lspace":1070,"rspace":1070},[63,12347,12348,12350,12352],{},[66,12349,2510],{"mathvariant":871},[66,12351,879],{"mathvariant":871},[66,12353,1267],{"mathvariant":871},[785,12355,12343],{},[143,12357,790],{},[70,12359,12360],{"encoding":72},"N = (k + 7) \\bmod 16",[13,12362,12364,12383,12404,12438],{"className":12363,"ariaHidden":77},[76],[13,12365,12367,12370,12374,12377,12380],{"className":12366},[81],[13,12368],{"className":12369,"style":6760},[85],[13,12371,12328],{"className":12372,"style":12373},[90,91],"margin-right:0.109em;",[13,12375],{"className":12376,"style":268},[267],[13,12378,566],{"className":12379},[272],[13,12381],{"className":12382,"style":268},[267],[13,12384,12386,12389,12392,12395,12398,12401],{"className":12385},[81],[13,12387],{"className":12388,"style":6163},[85],[13,12390,539],{"className":12391},[180],[13,12393,11809],{"className":12394,"style":12042},[90,91],[13,12396],{"className":12397,"style":351},[267],[13,12399,780],{"className":12400},[355],[13,12402],{"className":12403,"style":351},[267],[13,12405,12407,12410,12413,12416,12420,12423,12432,12435],{"className":12406},[81],[13,12408],{"className":12409,"style":6163},[85],[13,12411,10464],{"className":12412},[90],[13,12414,440],{"className":12415},[263],[13,12417],{"className":12418,"style":12419},[267],"margin-right:0.0556em;",[13,12421],{"className":12422,"style":351},[267],[13,12424,12426],{"className":12425},[355],[13,12427,12429],{"className":12428},[90],[13,12430,3045],{"className":12431},[90,922],[13,12433],{"className":12434,"style":12419},[267],[13,12436],{"className":12437,"style":351},[267],[13,12439,12441,12445],{"className":12440},[81],[13,12442],{"className":12443,"style":12444},[85],"height:0.6444em;",[13,12446,790],{"className":12447},[90],". In little-endian bytes, this 16-bit value is stored as ",[13,12450,12452,12493],{"className":12451},[50],[13,12453,12455],{"className":12454},[54],[56,12456,12457],{"xmlns":58},[60,12458,12459,12490],{},[63,12460,12461,12475,12477,12479,12481,12483],{},[782,12462,12463,12473],{},[63,12464,12465,12467,12469,12471],{},[66,12466,2567],{"mathvariant":871},[66,12468,10],{"mathvariant":871},[66,12470,1194],{"mathvariant":871},[66,12472,890],{"mathvariant":871},[143,12474,145],{},[147,12476,8716],{"stretchy":1079},[143,12478,1016],{},[147,12480,8722],{"stretchy":1079},[147,12482,566],{},[782,12484,12485,12488],{},[785,12486,12487],{},"00",[143,12489,790],{},[70,12491,12492],{"encoding":72},"\\mathrm{vptr}_2[0] = \\text{00}_{16}",[13,12494,12496,12563],{"className":12495,"ariaHidden":77},[76],[13,12497,12499,12502,12545,12548,12551,12554,12557,12560],{"className":12498},[81],[13,12500],{"className":12501,"style":6163},[85],[13,12503,12505,12511],{"className":12504},[90],[13,12506,12508],{"className":12507},[90],[13,12509,8744],{"className":12510},[90,922],[13,12512,12514],{"className":12513},[739],[13,12515,12517,12537],{"className":12516},[188,189],[13,12518,12520,12534],{"className":12519},[193],[13,12521,12523],{"className":12522,"style":8757},[197],[13,12524,12525,12528],{"style":8760},[13,12526],{"className":12527,"style":755},[205],[13,12529,12531],{"className":12530},[210,211,212,213],[13,12532,145],{"className":12533},[90,213],[13,12535,250],{"className":12536},[249],[13,12538,12540],{"className":12539},[193],[13,12541,12543],{"className":12542,"style":8779},[197],[13,12544],{},[13,12546,8716],{"className":12547},[180],[13,12549,1016],{"className":12550},[90],[13,12552,8722],{"className":12553},[263],[13,12555],{"className":12556,"style":268},[267],[13,12558,566],{"className":12559},[272],[13,12561],{"className":12562,"style":268},[267],[13,12564,12566,12569],{"className":12565},[81],[13,12567],{"className":12568,"style":803},[85],[13,12570,12572,12578],{"className":12571},[90],[13,12573,12575],{"className":12574},[90,687],[13,12576,12487],{"className":12577},[90],[13,12579,12581],{"className":12580},[739],[13,12582,12584,12607],{"className":12583},[188,189],[13,12585,12587,12604],{"className":12586},[193],[13,12588,12590],{"className":12589,"style":828},[197],[13,12591,12592,12595],{"style":831},[13,12593],{"className":12594,"style":755},[205],[13,12596,12598],{"className":12597},[210,211,212,213],[13,12599,12601],{"className":12600},[90,213],[13,12602,790],{"className":12603},[90,213],[13,12605,250],{"className":12606},[249],[13,12608,12610],{"className":12609},[193],[13,12611,12613],{"className":12612,"style":853},[197],[13,12614],{},", and ",[13,12617,12619,12671],{"className":12618},[50],[13,12620,12622],{"className":12621},[54],[56,12623,12624],{"xmlns":58},[60,12625,12626,12668],{},[63,12627,12628,12642,12644,12646,12648,12650,12652,12654,12656,12658,12660,12662],{},[782,12629,12630,12640],{},[63,12631,12632,12634,12636,12638],{},[66,12633,2567],{"mathvariant":871},[66,12635,10],{"mathvariant":871},[66,12637,1194],{"mathvariant":871},[66,12639,890],{"mathvariant":871},[143,12641,145],{},[147,12643,8716],{"stretchy":1079},[143,12645,1085],{},[147,12647,8722],{"stretchy":1079},[147,12649,566],{},[147,12651,539],{"stretchy":1079},[66,12653,12328],{},[147,12655,1088],{},[143,12657,2961],{},[147,12659,440],{"stretchy":1079},[147,12661,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[782,12663,12664,12666],{},[785,12665,7932],{},[143,12667,790],{},[70,12669,12670],{"encoding":72},"\\mathrm{vptr}_2[1] = (N \\ll 4) \\mathbin{|} \\text{E}_{16}",[13,12672,12674,12741,12762,12786],{"className":12673,"ariaHidden":77},[76],[13,12675,12677,12680,12723,12726,12729,12732,12735,12738],{"className":12676},[81],[13,12678],{"className":12679,"style":6163},[85],[13,12681,12683,12689],{"className":12682},[90],[13,12684,12686],{"className":12685},[90],[13,12687,8744],{"className":12688},[90,922],[13,12690,12692],{"className":12691},[739],[13,12693,12695,12715],{"className":12694},[188,189],[13,12696,12698,12712],{"className":12697},[193],[13,12699,12701],{"className":12700,"style":8757},[197],[13,12702,12703,12706],{"style":8760},[13,12704],{"className":12705,"style":755},[205],[13,12707,12709],{"className":12708},[210,211,212,213],[13,12710,145],{"className":12711},[90,213],[13,12713,250],{"className":12714},[249],[13,12716,12718],{"className":12717},[193],[13,12719,12721],{"className":12720,"style":8779},[197],[13,12722],{},[13,12724,8716],{"className":12725},[180],[13,12727,1085],{"className":12728},[90],[13,12730,8722],{"className":12731},[263],[13,12733],{"className":12734,"style":268},[267],[13,12736,566],{"className":12737},[272],[13,12739],{"className":12740,"style":268},[267],[13,12742,12744,12747,12750,12753,12756,12759],{"className":12743},[81],[13,12745],{"className":12746,"style":6163},[85],[13,12748,539],{"className":12749},[180],[13,12751,12328],{"className":12752,"style":12373},[90,91],[13,12754],{"className":12755,"style":268},[267],[13,12757,1088],{"className":12758},[272],[13,12760],{"className":12761,"style":268},[267],[13,12763,12765,12768,12771,12774,12777,12783],{"className":12764},[81],[13,12766],{"className":12767,"style":6163},[85],[13,12769,2961],{"className":12770},[90],[13,12772,440],{"className":12773},[263],[13,12775],{"className":12776,"style":351},[267],[13,12778,12780],{"className":12779},[355],[13,12781,7285],{"className":12782},[90],[13,12784],{"className":12785,"style":351},[267],[13,12787,12789,12792],{"className":12788},[81],[13,12790],{"className":12791,"style":938},[85],[13,12793,12795,12801],{"className":12794},[90],[13,12796,12798],{"className":12797},[90,687],[13,12799,7932],{"className":12800},[90],[13,12802,12804],{"className":12803},[739],[13,12805,12807,12830],{"className":12806},[188,189],[13,12808,12810,12827],{"className":12809},[193],[13,12811,12813],{"className":12812,"style":828},[197],[13,12814,12815,12818],{"style":831},[13,12816],{"className":12817,"style":755},[205],[13,12819,12821],{"className":12820},[210,211,212,213],[13,12822,12824],{"className":12823},[90,213],[13,12825,790],{"className":12826},[90,213],[13,12828,250],{"className":12829},[249],[13,12831,12833],{"className":12832},[193],[13,12834,12836],{"className":12835,"style":853},[197],[13,12837],{},[10,12839,12840,12841,12920,12921,92,13016,13111,13112,13192,13193,13358,13359,13438,13439,13723],{},"When read as a float32 coordinate, ",[13,12842,12844,12865],{"className":12843},[50],[13,12845,12847],{"className":12846},[54],[56,12848,12849],{"xmlns":58},[60,12850,12851,12863],{},[63,12852,12853],{},[782,12854,12855,12857],{},[66,12856,3262],{},[63,12858,12859,12861],{},[143,12860,1016],{},[66,12862,107],{},[70,12864,8900],{"encoding":72},[13,12866,12868],{"className":12867,"ariaHidden":77},[76],[13,12869,12871,12874],{"className":12870},[81],[13,12872],{"className":12873,"style":8910},[85],[13,12875,12877,12880],{"className":12876},[90],[13,12878,3262],{"className":12879,"style":4259},[90,91],[13,12881,12883],{"className":12882},[739],[13,12884,12886,12912],{"className":12885},[188,189],[13,12887,12889,12909],{"className":12888},[193],[13,12890,12892],{"className":12891,"style":828},[197],[13,12893,12894,12897],{"style":4274},[13,12895],{"className":12896,"style":755},[205],[13,12898,12900],{"className":12899},[210,211,212,213],[13,12901,12903,12906],{"className":12902},[90,213],[13,12904,1016],{"className":12905},[90,213],[13,12907,107],{"className":12908,"style":123},[90,91,213],[13,12910,250],{"className":12911},[249],[13,12913,12915],{"className":12914},[193],[13,12916,12918],{"className":12917,"style":8955},[197],[13,12919],{}," spans ",[13,12922,12924,12955],{"className":12923},[50],[13,12925,12927],{"className":12926},[54],[56,12928,12929],{"xmlns":58},[60,12930,12931,12953],{},[63,12932,12933,12947,12949,12951],{},[782,12934,12935,12945],{},[63,12936,12937,12939,12941,12943],{},[66,12938,2567],{"mathvariant":871},[66,12940,10],{"mathvariant":871},[66,12942,1194],{"mathvariant":871},[66,12944,890],{"mathvariant":871},[143,12946,1085],{},[147,12948,8716],{"stretchy":1079},[143,12950,8988],{},[147,12952,8722],{"stretchy":1079},[70,12954,8993],{"encoding":72},[13,12956,12958],{"className":12957,"ariaHidden":77},[76],[13,12959,12961,12964,13007,13010,13013],{"className":12960},[81],[13,12962],{"className":12963,"style":6163},[85],[13,12965,12967,12973],{"className":12966},[90],[13,12968,12970],{"className":12969},[90],[13,12971,8744],{"className":12972},[90,922],[13,12974,12976],{"className":12975},[739],[13,12977,12979,12999],{"className":12978},[188,189],[13,12980,12982,12996],{"className":12981},[193],[13,12983,12985],{"className":12984,"style":8757},[197],[13,12986,12987,12990],{"style":8760},[13,12988],{"className":12989,"style":755},[205],[13,12991,12993],{"className":12992},[210,211,212,213],[13,12994,1085],{"className":12995},[90,213],[13,12997,250],{"className":12998},[249],[13,13000,13002],{"className":13001},[193],[13,13003,13005],{"className":13004,"style":8779},[197],[13,13006],{},[13,13008,8716],{"className":13009},[180],[13,13011,8988],{"className":13012},[90],[13,13014,8722],{"className":13015},[263],[13,13017,13019,13050],{"className":13018},[50],[13,13020,13022],{"className":13021},[54],[56,13023,13024],{"xmlns":58},[60,13025,13026,13048],{},[63,13027,13028,13042,13044,13046],{},[782,13029,13030,13040],{},[63,13031,13032,13034,13036,13038],{},[66,13033,2567],{"mathvariant":871},[66,13035,10],{"mathvariant":871},[66,13037,1194],{"mathvariant":871},[66,13039,890],{"mathvariant":871},[143,13041,145],{},[147,13043,8716],{"stretchy":1079},[143,13045,9085],{},[147,13047,8722],{"stretchy":1079},[70,13049,9090],{"encoding":72},[13,13051,13053],{"className":13052,"ariaHidden":77},[76],[13,13054,13056,13059,13102,13105,13108],{"className":13055},[81],[13,13057],{"className":13058,"style":6163},[85],[13,13060,13062,13068],{"className":13061},[90],[13,13063,13065],{"className":13064},[90],[13,13066,8744],{"className":13067},[90,922],[13,13069,13071],{"className":13070},[739],[13,13072,13074,13094],{"className":13073},[188,189],[13,13075,13077,13091],{"className":13076},[193],[13,13078,13080],{"className":13079,"style":8757},[197],[13,13081,13082,13085],{"style":8760},[13,13083],{"className":13084,"style":755},[205],[13,13086,13088],{"className":13087},[210,211,212,213],[13,13089,145],{"className":13090},[90,213],[13,13092,250],{"className":13093},[249],[13,13095,13097],{"className":13096},[193],[13,13098,13100],{"className":13099,"style":8779},[197],[13,13101],{},[13,13103,8716],{"className":13104},[180],[13,13106,9085],{"className":13107},[90],[13,13109,8722],{"className":13110},[263],". Because canonical user-space pointers on x86_64 only use the low 48 bits, the upper two bytes of ",[13,13113,13115,13140],{"className":13114},[50],[13,13116,13118],{"className":13117},[54],[56,13119,13120],{"xmlns":58},[60,13121,13122,13138],{},[63,13123,13124],{},[782,13125,13126,13136],{},[63,13127,13128,13130,13132,13134],{},[66,13129,2567],{"mathvariant":871},[66,13131,10],{"mathvariant":871},[66,13133,1194],{"mathvariant":871},[66,13135,890],{"mathvariant":871},[143,13137,1085],{},[70,13139,8820],{"encoding":72},[13,13141,13143],{"className":13142,"ariaHidden":77},[76],[13,13144,13146,13149],{"className":13145},[81],[13,13147],{"className":13148,"style":8830},[85],[13,13150,13152,13158],{"className":13151},[90],[13,13153,13155],{"className":13154},[90],[13,13156,8744],{"className":13157},[90,922],[13,13159,13161],{"className":13160},[739],[13,13162,13164,13184],{"className":13163},[188,189],[13,13165,13167,13181],{"className":13166},[193],[13,13168,13170],{"className":13169,"style":8757},[197],[13,13171,13172,13175],{"style":8760},[13,13173],{"className":13174,"style":755},[205],[13,13176,13178],{"className":13177},[210,211,212,213],[13,13179,1085],{"className":13180},[90,213],[13,13182,250],{"className":13183},[249],[13,13185,13187],{"className":13186},[193],[13,13188,13190],{"className":13189,"style":8779},[197],[13,13191],{}," are always zero (",[13,13194,13196,13236],{"className":13195},[50],[13,13197,13199],{"className":13198},[54],[56,13200,13201],{"xmlns":58},[60,13202,13203,13233],{},[63,13204,13205,13219,13221,13223,13225,13227],{},[782,13206,13207,13217],{},[63,13208,13209,13211,13213,13215],{},[66,13210,2567],{"mathvariant":871},[66,13212,10],{"mathvariant":871},[66,13214,1194],{"mathvariant":871},[66,13216,890],{"mathvariant":871},[143,13218,1085],{},[147,13220,8716],{"stretchy":1079},[143,13222,8988],{},[147,13224,8722],{"stretchy":1079},[147,13226,566],{},[782,13228,13229,13231],{},[785,13230,10577],{},[143,13232,790],{},[70,13234,13235],{"encoding":72},"\\mathrm{vptr}_1[6..7] = \\text{0000}_{16}",[13,13237,13239,13306],{"className":13238,"ariaHidden":77},[76],[13,13240,13242,13245,13288,13291,13294,13297,13300,13303],{"className":13241},[81],[13,13243],{"className":13244,"style":6163},[85],[13,13246,13248,13254],{"className":13247},[90],[13,13249,13251],{"className":13250},[90],[13,13252,8744],{"className":13253},[90,922],[13,13255,13257],{"className":13256},[739],[13,13258,13260,13280],{"className":13259},[188,189],[13,13261,13263,13277],{"className":13262},[193],[13,13264,13266],{"className":13265,"style":8757},[197],[13,13267,13268,13271],{"style":8760},[13,13269],{"className":13270,"style":755},[205],[13,13272,13274],{"className":13273},[210,211,212,213],[13,13275,1085],{"className":13276},[90,213],[13,13278,250],{"className":13279},[249],[13,13281,13283],{"className":13282},[193],[13,13284,13286],{"className":13285,"style":8779},[197],[13,13287],{},[13,13289,8716],{"className":13290},[180],[13,13292,8988],{"className":13293},[90],[13,13295,8722],{"className":13296},[263],[13,13298],{"className":13299,"style":268},[267],[13,13301,566],{"className":13302},[272],[13,13304],{"className":13305,"style":268},[267],[13,13307,13309,13312],{"className":13308},[81],[13,13310],{"className":13311,"style":803},[85],[13,13313,13315,13321],{"className":13314},[90],[13,13316,13318],{"className":13317},[90,687],[13,13319,10577],{"className":13320},[90],[13,13322,13324],{"className":13323},[739],[13,13325,13327,13350],{"className":13326},[188,189],[13,13328,13330,13347],{"className":13329},[193],[13,13331,13333],{"className":13332,"style":828},[197],[13,13334,13335,13338],{"style":831},[13,13336],{"className":13337,"style":755},[205],[13,13339,13341],{"className":13340},[210,211,212,213],[13,13342,13344],{"className":13343},[90,213],[13,13345,790],{"className":13346},[90,213],[13,13348,250],{"className":13349},[249],[13,13351,13353],{"className":13352},[193],[13,13354,13356],{"className":13355,"style":853},[197],[13,13357],{},"). Thus, the raw 32-bit memory buffer for ",[13,13360,13362,13383],{"className":13361},[50],[13,13363,13365],{"className":13364},[54],[56,13366,13367],{"xmlns":58},[60,13368,13369,13381],{},[63,13370,13371],{},[782,13372,13373,13375],{},[66,13374,3262],{},[63,13376,13377,13379],{},[143,13378,1016],{},[66,13380,107],{},[70,13382,8900],{"encoding":72},[13,13384,13386],{"className":13385,"ariaHidden":77},[76],[13,13387,13389,13392],{"className":13388},[81],[13,13390],{"className":13391,"style":8910},[85],[13,13393,13395,13398],{"className":13394},[90],[13,13396,3262],{"className":13397,"style":4259},[90,91],[13,13399,13401],{"className":13400},[739],[13,13402,13404,13430],{"className":13403},[188,189],[13,13405,13407,13427],{"className":13406},[193],[13,13408,13410],{"className":13409,"style":828},[197],[13,13411,13412,13415],{"style":4274},[13,13413],{"className":13414,"style":755},[205],[13,13416,13418],{"className":13417},[210,211,212,213],[13,13419,13421,13424],{"className":13420},[90,213],[13,13422,1016],{"className":13423},[90,213],[13,13425,107],{"className":13426,"style":123},[90,91,213],[13,13428,250],{"className":13429},[249],[13,13431,13433],{"className":13432},[193],[13,13434,13436],{"className":13435,"style":8955},[197],[13,13437],{}," contains the bytes ",[13,13440,13442,13502],{"className":13441},[50],[13,13443,13445],{"className":13444},[54],[56,13446,13447],{"xmlns":58},[60,13448,13449,13499],{},[63,13450,13451,13453,13459,13461,13467,13469,13475,13477,13491,13493,13495,13497],{},[147,13452,8716],{"stretchy":1079},[782,13454,13455,13457],{},[785,13456,12487],{},[143,13458,790],{},[147,13460,160],{"separator":77},[782,13462,13463,13465],{},[785,13464,12487],{},[143,13466,790],{},[147,13468,160],{"separator":77},[782,13470,13471,13473],{},[785,13472,12487],{},[143,13474,790],{},[147,13476,160],{"separator":77},[782,13478,13479,13489],{},[63,13480,13481,13483,13485,13487],{},[66,13482,2567],{"mathvariant":871},[66,13484,10],{"mathvariant":871},[66,13486,1194],{"mathvariant":871},[66,13488,890],{"mathvariant":871},[143,13490,145],{},[147,13492,8716],{"stretchy":1079},[143,13494,1085],{},[147,13496,8722],{"stretchy":1079},[147,13498,8722],{"stretchy":1079},[70,13500,13501],{"encoding":72},"[\\text{00}_{16}, \\text{00}_{16}, \\text{00}_{16}, \\mathrm{vptr}_2[1]]",[13,13503,13505],{"className":13504,"ariaHidden":77},[76],[13,13506,13508,13511,13514,13560,13563,13566,13612,13615,13618,13664,13667,13670,13713,13716,13719],{"className":13507},[81],[13,13509],{"className":13510,"style":6163},[85],[13,13512,8716],{"className":13513},[180],[13,13515,13517,13523],{"className":13516},[90],[13,13518,13520],{"className":13519},[90,687],[13,13521,12487],{"className":13522},[90],[13,13524,13526],{"className":13525},[739],[13,13527,13529,13552],{"className":13528},[188,189],[13,13530,13532,13549],{"className":13531},[193],[13,13533,13535],{"className":13534,"style":828},[197],[13,13536,13537,13540],{"style":831},[13,13538],{"className":13539,"style":755},[205],[13,13541,13543],{"className":13542},[210,211,212,213],[13,13544,13546],{"className":13545},[90,213],[13,13547,790],{"className":13548},[90,213],[13,13550,250],{"className":13551},[249],[13,13553,13555],{"className":13554},[193],[13,13556,13558],{"className":13557,"style":853},[197],[13,13559],{},[13,13561,160],{"className":13562},[311],[13,13564],{"className":13565,"style":8430},[267],[13,13567,13569,13575],{"className":13568},[90],[13,13570,13572],{"className":13571},[90,687],[13,13573,12487],{"className":13574},[90],[13,13576,13578],{"className":13577},[739],[13,13579,13581,13604],{"className":13580},[188,189],[13,13582,13584,13601],{"className":13583},[193],[13,13585,13587],{"className":13586,"style":828},[197],[13,13588,13589,13592],{"style":831},[13,13590],{"className":13591,"style":755},[205],[13,13593,13595],{"className":13594},[210,211,212,213],[13,13596,13598],{"className":13597},[90,213],[13,13599,790],{"className":13600},[90,213],[13,13602,250],{"className":13603},[249],[13,13605,13607],{"className":13606},[193],[13,13608,13610],{"className":13609,"style":853},[197],[13,13611],{},[13,13613,160],{"className":13614},[311],[13,13616],{"className":13617,"style":8430},[267],[13,13619,13621,13627],{"className":13620},[90],[13,13622,13624],{"className":13623},[90,687],[13,13625,12487],{"className":13626},[90],[13,13628,13630],{"className":13629},[739],[13,13631,13633,13656],{"className":13632},[188,189],[13,13634,13636,13653],{"className":13635},[193],[13,13637,13639],{"className":13638,"style":828},[197],[13,13640,13641,13644],{"style":831},[13,13642],{"className":13643,"style":755},[205],[13,13645,13647],{"className":13646},[210,211,212,213],[13,13648,13650],{"className":13649},[90,213],[13,13651,790],{"className":13652},[90,213],[13,13654,250],{"className":13655},[249],[13,13657,13659],{"className":13658},[193],[13,13660,13662],{"className":13661,"style":853},[197],[13,13663],{},[13,13665,160],{"className":13666},[311],[13,13668],{"className":13669,"style":8430},[267],[13,13671,13673,13679],{"className":13672},[90],[13,13674,13676],{"className":13675},[90],[13,13677,8744],{"className":13678},[90,922],[13,13680,13682],{"className":13681},[739],[13,13683,13685,13705],{"className":13684},[188,189],[13,13686,13688,13702],{"className":13687},[193],[13,13689,13691],{"className":13690,"style":8757},[197],[13,13692,13693,13696],{"style":8760},[13,13694],{"className":13695,"style":755},[205],[13,13697,13699],{"className":13698},[210,211,212,213],[13,13700,145],{"className":13701},[90,213],[13,13703,250],{"className":13704},[249],[13,13706,13708],{"className":13707},[193],[13,13709,13711],{"className":13710,"style":8779},[197],[13,13712],{},[13,13714,8716],{"className":13715},[180],[13,13717,1085],{"className":13718},[90],[13,13720,13722],{"className":13721},[263],"]]",", which translates to the bit pattern:",[13,13725,13727],{"className":13726},[989],[13,13728,13730,13848],{"className":13729},[50],[13,13731,13733],{"className":13732},[54],[56,13734,13735],{"xmlns":58,"display":998},[60,13736,13737,13845],{},[1002,13738,13739,13801],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},[1008,13740,13741,13767],{},[1011,13742,13743],{},[1014,13744,13745],{"scriptlevel":1016,"displaystyle":77},[782,13746,13747,13749],{},[66,13748,3262],{},[63,13750,13751,13753,13755,13757],{},[143,13752,1016],{},[66,13754,107],{},[147,13756,160],{"separator":77},[63,13758,13759,13761,13763,13765],{},[66,13760,1033],{"mathvariant":871},[66,13762,2521],{"mathvariant":871},[66,13764,1194],{"mathvariant":871},[66,13766,1039],{"mathvariant":871},[1011,13768,13769],{},[1014,13770,13771],{"scriptlevel":1016,"displaystyle":77},[63,13772,13773,13775,13777,13791,13793,13795,13797,13799],{},[63,13774],{},[147,13776,566],{},[782,13778,13779,13789],{},[63,13780,13781,13783,13785,13787],{},[66,13782,2567],{"mathvariant":871},[66,13784,10],{"mathvariant":871},[66,13786,1194],{"mathvariant":871},[66,13788,890],{"mathvariant":871},[143,13790,145],{},[147,13792,8716],{"stretchy":1079},[143,13794,1085],{},[147,13796,8722],{"stretchy":1079},[147,13798,1088],{},[143,13800,10409],{},[1008,13802,13803,13809],{},[1011,13804,13805],{},[1014,13806,13807],{"scriptlevel":1016,"displaystyle":77},[63,13808],{},[1011,13810,13811],{},[1014,13812,13813],{"scriptlevel":1016,"displaystyle":77},[63,13814,13815,13817,13819,13821,13823,13825,13827,13829,13831,13833,13839,13841,13843],{},[63,13816],{},[147,13818,566],{},[147,13820,539],{"fence":1079,"stretchy":77,"minsize":1080,"maxsize":1080},[147,13822,539],{"stretchy":1079},[66,13824,12328],{},[147,13826,1088],{},[143,13828,2961],{},[147,13830,440],{"stretchy":1079},[147,13832,7285],{"mathvariant":871,"lspace":1070,"rspace":1070},[782,13834,13835,13837],{},[785,13836,7932],{},[143,13838,790],{},[147,13840,440],{"fence":1079,"stretchy":77,"minsize":1080,"maxsize":1080},[147,13842,1088],{},[143,13844,10409],{},[70,13846,13847],{"encoding":72},"\\begin{aligned}\nP_{0y,\\mathrm{bits}} &= \\mathrm{vptr}_2[1] \\ll 24 \\\\\n&= \\big((N \\ll 4) \\mathbin{|} \\text{E}_{16}\\big) \\ll 24\n\\end{aligned}",[13,13849,13851],{"className":13850,"ariaHidden":77},[76],[13,13852,13854,13858],{"className":13853},[81],[13,13855],{"className":13856,"style":13857},[85],"height:2.71em;vertical-align:-1.105em;",[13,13859,13861],{"className":13860},[90],[13,13862,13864,13964],{"className":13863},[1002],[13,13865,13867],{"className":13866},[1363],[13,13868,13870,13955],{"className":13869},[188,189],[13,13871,13873,13952],{"className":13872},[193],[13,13874,13877,13943],{"className":13875,"style":13876},[197],"height:1.605em;",[13,13878,13880,13883],{"style":13879},"top:-3.765em;",[13,13881],{"className":13882,"style":206},[205],[13,13884,13886],{"className":13885},[90],[13,13887,13889,13892],{"className":13888},[90],[13,13890,3262],{"className":13891,"style":4259},[90,91],[13,13893,13895],{"className":13894},[739],[13,13896,13898,13935],{"className":13897},[188,189],[13,13899,13901,13932],{"className":13900},[193],[13,13902,13905],{"className":13903,"style":13904},[197],"height:0.3361em;",[13,13906,13907,13910],{"style":4274},[13,13908],{"className":13909,"style":755},[205],[13,13911,13913],{"className":13912},[210,211,212,213],[13,13914,13916,13919,13922,13925],{"className":13915},[90,213],[13,13917,1016],{"className":13918},[90,213],[13,13920,107],{"className":13921,"style":123},[90,91,213],[13,13923,160],{"className":13924},[311,213],[13,13926,13928],{"className":13927},[90,213],[13,13929,13931],{"className":13930},[90,922,213],"bits",[13,13933,250],{"className":13934},[249],[13,13936,13938],{"className":13937},[193],[13,13939,13941],{"className":13940,"style":8955},[197],[13,13942],{},[13,13944,13946,13949],{"style":13945},"top:-2.255em;",[13,13947],{"className":13948,"style":206},[205],[13,13950],{"className":13951},[90],[13,13953,250],{"className":13954},[249],[13,13956,13958],{"className":13957},[193],[13,13959,13962],{"className":13960,"style":13961},[197],"height:1.105em;",[13,13963],{},[13,13965,13967],{"className":13966},[1456],[13,13968,13970,14186],{"className":13969},[188,189],[13,13971,13973,14183],{"className":13972},[193],[13,13974,13976,14060],{"className":13975,"style":13876},[197],[13,13977,13978,13981],{"style":13879},[13,13979],{"className":13980,"style":206},[205],[13,13982,13984,13987,13990,13993,13996,14039,14042,14045,14048,14051,14054,14057],{"className":13983},[90],[13,13985],{"className":13986},[90],[13,13988],{"className":13989,"style":268},[267],[13,13991,566],{"className":13992},[272],[13,13994],{"className":13995,"style":268},[267],[13,13997,13999,14005],{"className":13998},[90],[13,14000,14002],{"className":14001},[90],[13,14003,8744],{"className":14004},[90,922],[13,14006,14008],{"className":14007},[739],[13,14009,14011,14031],{"className":14010},[188,189],[13,14012,14014,14028],{"className":14013},[193],[13,14015,14017],{"className":14016,"style":8757},[197],[13,14018,14019,14022],{"style":8760},[13,14020],{"className":14021,"style":755},[205],[13,14023,14025],{"className":14024},[210,211,212,213],[13,14026,145],{"className":14027},[90,213],[13,14029,250],{"className":14030},[249],[13,14032,14034],{"className":14033},[193],[13,14035,14037],{"className":14036,"style":8779},[197],[13,14038],{},[13,14040,8716],{"className":14041},[180],[13,14043,1085],{"className":14044},[90],[13,14046,8722],{"className":14047},[263],[13,14049],{"className":14050,"style":268},[267],[13,14052,1088],{"className":14053},[272],[13,14055],{"className":14056,"style":268},[267],[13,14058,10409],{"className":14059},[90],[13,14061,14062,14065],{"style":13945},[13,14063],{"className":14064,"style":206},[205],[13,14066,14068,14071,14074,14077,14080,14086,14089,14092,14095,14098,14101,14104,14107,14110,14116,14119,14165,14171,14174,14177,14180],{"className":14067},[90],[13,14069],{"className":14070},[90],[13,14072],{"className":14073,"style":268},[267],[13,14075,566],{"className":14076},[272],[13,14078],{"className":14079,"style":268},[267],[13,14081,14083],{"className":14082},[90],[13,14084,539],{"className":14085},[1520,1521],[13,14087,539],{"className":14088},[180],[13,14090,12328],{"className":14091,"style":12373},[90,91],[13,14093],{"className":14094,"style":268},[267],[13,14096,1088],{"className":14097},[272],[13,14099],{"className":14100,"style":268},[267],[13,14102,2961],{"className":14103},[90],[13,14105,440],{"className":14106},[263],[13,14108],{"className":14109,"style":351},[267],[13,14111,14113],{"className":14112},[355],[13,14114,7285],{"className":14115},[90],[13,14117],{"className":14118,"style":351},[267],[13,14120,14122,14128],{"className":14121},[90],[13,14123,14125],{"className":14124},[90,687],[13,14126,7932],{"className":14127},[90],[13,14129,14131],{"className":14130},[739],[13,14132,14134,14157],{"className":14133},[188,189],[13,14135,14137,14154],{"className":14136},[193],[13,14138,14140],{"className":14139,"style":828},[197],[13,14141,14142,14145],{"style":831},[13,14143],{"className":14144,"style":755},[205],[13,14146,14148],{"className":14147},[210,211,212,213],[13,14149,14151],{"className":14150},[90,213],[13,14152,790],{"className":14153},[90,213],[13,14155,250],{"className":14156},[249],[13,14158,14160],{"className":14159},[193],[13,14161,14163],{"className":14162,"style":853},[197],[13,14164],{},[13,14166,14168],{"className":14167},[90],[13,14169,440],{"className":14170},[1520,1521],[13,14172],{"className":14173,"style":268},[267],[13,14175,1088],{"className":14176},[272],[13,14178],{"className":14179,"style":268},[267],[13,14181,10409],{"className":14182},[90],[13,14184,250],{"className":14185},[249],[13,14187,14189],{"className":14188},[193],[13,14190,14192],{"className":14191,"style":13961},[197],[13,14193],{},[10,14195,14196,14197,14298],{},"In the IEEE 754 single-precision format, the 32 bits are divided into a sign bit (bit 31), an 8-bit exponent (bits 30..23), and a 23-bit mantissa (bits 22..0). Mapping ",[13,14198,14200,14234],{"className":14199},[50],[13,14201,14203],{"className":14202},[54],[56,14204,14205],{"xmlns":58},[60,14206,14207,14231],{},[63,14208,14209],{},[782,14210,14211,14213],{},[66,14212,3262],{},[63,14214,14215,14217,14219,14221],{},[143,14216,1016],{},[66,14218,107],{},[147,14220,160],{"separator":77},[63,14222,14223,14225,14227,14229],{},[66,14224,1033],{"mathvariant":871},[66,14226,2521],{"mathvariant":871},[66,14228,1194],{"mathvariant":871},[66,14230,1039],{"mathvariant":871},[70,14232,14233],{"encoding":72},"P_{0y,\\mathrm{bits}}",[13,14235,14237],{"className":14236,"ariaHidden":77},[76],[13,14238,14240,14243],{"className":14239},[81],[13,14241],{"className":14242,"style":8910},[85],[13,14244,14246,14249],{"className":14245},[90],[13,14247,3262],{"className":14248,"style":4259},[90,91],[13,14250,14252],{"className":14251},[739],[13,14253,14255,14290],{"className":14254},[188,189],[13,14256,14258,14287],{"className":14257},[193],[13,14259,14261],{"className":14260,"style":13904},[197],[13,14262,14263,14266],{"style":4274},[13,14264],{"className":14265,"style":755},[205],[13,14267,14269],{"className":14268},[210,211,212,213],[13,14270,14272,14275,14278,14281],{"className":14271},[90,213],[13,14273,1016],{"className":14274},[90,213],[13,14276,107],{"className":14277,"style":123},[90,91,213],[13,14279,160],{"className":14280},[311,213],[13,14282,14284],{"className":14283},[90,213],[13,14285,13931],{"className":14286},[90,922,213],[13,14288,250],{"className":14289},[249],[13,14291,14293],{"className":14292},[193],[13,14294,14296],{"className":14295,"style":8955},[197],[13,14297],{}," to these fields yields:",[13,14300,14302],{"className":14301},[989],[13,14303,14305,14542],{"className":14304},[50],[13,14306,14308],{"className":14307},[54],[56,14309,14310],{"xmlns":58,"display":998},[60,14311,14312,14539],{},[1002,14313,14314,14406,14487],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},[1008,14315,14316,14322],{},[1011,14317,14318],{},[1014,14319,14320],{"scriptlevel":1016,"displaystyle":77},[66,14321,3217],{},[1011,14323,14324],{},[1014,14325,14326],{"scriptlevel":1016,"displaystyle":77},[63,14327,14328,14330,14332,14335,14338,14341,14363,14365,14367,14369,14371,14385,14387,14389,14391,14393,14396,14398,14401,14403],{},[63,14329],{},[147,14331,566],{},[785,14333,14334],{},"bit ",[143,14336,14337],{},"31",[785,14339,14340],{}," of ",[782,14342,14343,14345],{},[66,14344,3262],{},[63,14346,14347,14349,14351,14353],{},[143,14348,1016],{},[66,14350,107],{},[147,14352,160],{"separator":77},[63,14354,14355,14357,14359,14361],{},[66,14356,1033],{"mathvariant":871},[66,14358,2521],{"mathvariant":871},[66,14360,1194],{"mathvariant":871},[66,14362,1039],{"mathvariant":871},[147,14364,566],{},[785,14366,14334],{},[143,14368,10464],{},[785,14370,14340],{},[782,14372,14373,14383],{},[63,14374,14375,14377,14379,14381],{},[66,14376,2567],{"mathvariant":871},[66,14378,10],{"mathvariant":871},[66,14380,1194],{"mathvariant":871},[66,14382,890],{"mathvariant":871},[143,14384,145],{},[147,14386,8716],{"stretchy":1079},[143,14388,1085],{},[147,14390,8722],{"stretchy":1079},[147,14392,566],{},[147,14394,14395],{"stretchy":1079},"⌊",[66,14397,12328],{},[66,14399,14400],{"mathvariant":871},"\u002F",[143,14402,3241],{},[147,14404,14405],{"stretchy":1079},"⌋",[1008,14407,14408,14414],{},[1011,14409,14410],{},[1014,14411,14412],{"scriptlevel":1016,"displaystyle":77},[66,14413,7932],{},[1011,14415,14416],{},[1014,14417,14418],{"scriptlevel":1016,"displaystyle":77},[63,14419,14420,14422,14424,14427,14430,14432,14454,14456,14458,14460,14462,14472,14474,14476,14478,14480,14482,14484],{},[63,14421],{},[147,14423,566],{},[785,14425,14426],{},"bits ",[143,14428,14429],{},"30..23",[785,14431,14340],{},[782,14433,14434,14436],{},[66,14435,3262],{},[63,14437,14438,14440,14442,14444],{},[143,14439,1016],{},[66,14441,107],{},[147,14443,160],{"separator":77},[63,14445,14446,14448,14450,14452],{},[66,14447,1033],{"mathvariant":871},[66,14449,2521],{"mathvariant":871},[66,14451,1194],{"mathvariant":871},[66,14453,1039],{"mathvariant":871},[147,14455,566],{},[147,14457,539],{"stretchy":1079},[66,14459,12328],{},[785,14461,12343],{},[147,14463,14464],{"lspace":1070,"rspace":1070},[63,14465,14466,14468,14470],{},[66,14467,2510],{"mathvariant":871},[66,14469,879],{"mathvariant":871},[66,14471,1267],{"mathvariant":871},[785,14473,12343],{},[143,14475,3241],{},[147,14477,440],{"stretchy":1079},[147,14479,2628],{},[143,14481,1230],{},[147,14483,780],{},[143,14485,14486],{},"28",[1008,14488,14489,14496],{},[1011,14490,14491],{},[1014,14492,14493],{"scriptlevel":1016,"displaystyle":77},[66,14494,14495],{},"M",[1011,14497,14498],{},[1014,14499,14500],{"scriptlevel":1016,"displaystyle":77},[63,14501,14502,14504,14506,14508,14511,14513,14535,14537],{},[63,14503],{},[147,14505,566],{},[785,14507,14426],{},[143,14509,14510],{},"22..0",[785,14512,14340],{},[782,14514,14515,14517],{},[66,14516,3262],{},[63,14518,14519,14521,14523,14525],{},[143,14520,1016],{},[66,14522,107],{},[147,14524,160],{"separator":77},[63,14526,14527,14529,14531,14533],{},[66,14528,1033],{"mathvariant":871},[66,14530,2521],{"mathvariant":871},[66,14532,1194],{"mathvariant":871},[66,14534,1039],{"mathvariant":871},[147,14536,566],{},[143,14538,1016],{},[70,14540,14541],{"encoding":72},"\\begin{aligned}\nS &= \\text{bit } 31 \\text{ of } P_{0y,\\mathrm{bits}} = \\text{bit } 7 \\text{ of } \\mathrm{vptr}_2[1] = \\lfloor N \u002F 8 \\rfloor \\\\\nE &= \\text{bits } 30..23 \\text{ of } P_{0y,\\mathrm{bits}} = (N \\bmod 8) \\cdot 32 + 28 \\\\\nM &= \\text{bits } 22..0 \\text{ of } P_{0y,\\mathrm{bits}} = 0\n\\end{aligned}",[13,14543,14545],{"className":14544,"ariaHidden":77},[76],[13,14546,14548,14551],{"className":14547},[81],[13,14549],{"className":14550,"style":3365},[85],[13,14552,14554],{"className":14553},[90],[13,14555,14557,14613],{"className":14556},[1002],[13,14558,14560],{"className":14559},[1363],[13,14561,14563,14605],{"className":14562},[188,189],[13,14564,14566,14602],{"className":14565},[193],[13,14567,14569,14580,14591],{"className":14568,"style":3384},[197],[13,14570,14571,14574],{"style":3387},[13,14572],{"className":14573,"style":206},[205],[13,14575,14577],{"className":14576},[90],[13,14578,3217],{"className":14579,"style":4198},[90,91],[13,14581,14582,14585],{"style":3403},[13,14583],{"className":14584,"style":206},[205],[13,14586,14588],{"className":14587},[90],[13,14589,7932],{"className":14590,"style":4198},[90,91],[13,14592,14593,14596],{"style":3426},[13,14594],{"className":14595,"style":206},[205],[13,14597,14599],{"className":14598},[90],[13,14600,14495],{"className":14601,"style":12373},[90,91],[13,14603,250],{"className":14604},[249],[13,14606,14608],{"className":14607},[193],[13,14609,14611],{"className":14610,"style":3442},[197],[13,14612],{},[13,14614,14616],{"className":14615},[1456],[13,14617,14619,15074],{"className":14618},[188,189],[13,14620,14622,15071],{"className":14621},[193],[13,14623,14625,14813,14969],{"className":14624,"style":3384},[197],[13,14626,14627,14630],{"style":3387},[13,14628],{"className":14629,"style":206},[205],[13,14631,14633,14636,14639,14642,14645,14651,14654,14660,14715,14718,14721,14724,14730,14733,14739,14782,14785,14788,14791,14794,14797,14800,14803,14806,14810],{"className":14632},[90],[13,14634],{"className":14635},[90],[13,14637],{"className":14638,"style":268},[267],[13,14640,566],{"className":14641},[272],[13,14643],{"className":14644,"style":268},[267],[13,14646,14648],{"className":14647},[90,687],[13,14649,14334],{"className":14650},[90],[13,14652,14337],{"className":14653},[90],[13,14655,14657],{"className":14656},[90,687],[13,14658,14340],{"className":14659},[90],[13,14661,14663,14666],{"className":14662},[90],[13,14664,3262],{"className":14665,"style":4259},[90,91],[13,14667,14669],{"className":14668},[739],[13,14670,14672,14707],{"className":14671},[188,189],[13,14673,14675,14704],{"className":14674},[193],[13,14676,14678],{"className":14677,"style":13904},[197],[13,14679,14680,14683],{"style":4274},[13,14681],{"className":14682,"style":755},[205],[13,14684,14686],{"className":14685},[210,211,212,213],[13,14687,14689,14692,14695,14698],{"className":14688},[90,213],[13,14690,1016],{"className":14691},[90,213],[13,14693,107],{"className":14694,"style":123},[90,91,213],[13,14696,160],{"className":14697},[311,213],[13,14699,14701],{"className":14700},[90,213],[13,14702,13931],{"className":14703},[90,922,213],[13,14705,250],{"className":14706},[249],[13,14708,14710],{"className":14709},[193],[13,14711,14713],{"className":14712,"style":8955},[197],[13,14714],{},[13,14716],{"className":14717,"style":268},[267],[13,14719,566],{"className":14720},[272],[13,14722],{"className":14723,"style":268},[267],[13,14725,14727],{"className":14726},[90,687],[13,14728,14334],{"className":14729},[90],[13,14731,10464],{"className":14732},[90],[13,14734,14736],{"className":14735},[90,687],[13,14737,14340],{"className":14738},[90],[13,14740,14742,14748],{"className":14741},[90],[13,14743,14745],{"className":14744},[90],[13,14746,8744],{"className":14747},[90,922],[13,14749,14751],{"className":14750},[739],[13,14752,14754,14774],{"className":14753},[188,189],[13,14755,14757,14771],{"className":14756},[193],[13,14758,14760],{"className":14759,"style":8757},[197],[13,14761,14762,14765],{"style":8760},[13,14763],{"className":14764,"style":755},[205],[13,14766,14768],{"className":14767},[210,211,212,213],[13,14769,145],{"className":14770},[90,213],[13,14772,250],{"className":14773},[249],[13,14775,14777],{"className":14776},[193],[13,14778,14780],{"className":14779,"style":8779},[197],[13,14781],{},[13,14783,8716],{"className":14784},[180],[13,14786,1085],{"className":14787},[90],[13,14789,8722],{"className":14790},[263],[13,14792],{"className":14793,"style":268},[267],[13,14795,566],{"className":14796},[272],[13,14798],{"className":14799,"style":268},[267],[13,14801,14395],{"className":14802},[180],[13,14804,12328],{"className":14805,"style":12373},[90,91],[13,14807,14809],{"className":14808},[90],"\u002F8",[13,14811,14405],{"className":14812},[263],[13,14814,14815,14818],{"style":3403},[13,14816],{"className":14817,"style":206},[205],[13,14819,14821,14824,14827,14830,14833,14839,14842,14848,14903,14906,14909,14912,14915,14918,14921,14924,14933,14936,14939,14942,14945,14948,14951,14954,14957,14960,14963,14966],{"className":14820},[90],[13,14822],{"className":14823},[90],[13,14825],{"className":14826,"style":268},[267],[13,14828,566],{"className":14829},[272],[13,14831],{"className":14832,"style":268},[267],[13,14834,14836],{"className":14835},[90,687],[13,14837,14426],{"className":14838},[90],[13,14840,14429],{"className":14841},[90],[13,14843,14845],{"className":14844},[90,687],[13,14846,14340],{"className":14847},[90],[13,14849,14851,14854],{"className":14850},[90],[13,14852,3262],{"className":14853,"style":4259},[90,91],[13,14855,14857],{"className":14856},[739],[13,14858,14860,14895],{"className":14859},[188,189],[13,14861,14863,14892],{"className":14862},[193],[13,14864,14866],{"className":14865,"style":13904},[197],[13,14867,14868,14871],{"style":4274},[13,14869],{"className":14870,"style":755},[205],[13,14872,14874],{"className":14873},[210,211,212,213],[13,14875,14877,14880,14883,14886],{"className":14876},[90,213],[13,14878,1016],{"className":14879},[90,213],[13,14881,107],{"className":14882,"style":123},[90,91,213],[13,14884,160],{"className":14885},[311,213],[13,14887,14889],{"className":14888},[90,213],[13,14890,13931],{"className":14891},[90,922,213],[13,14893,250],{"className":14894},[249],[13,14896,14898],{"className":14897},[193],[13,14899,14901],{"className":14900,"style":8955},[197],[13,14902],{},[13,14904],{"className":14905,"style":268},[267],[13,14907,566],{"className":14908},[272],[13,14910],{"className":14911,"style":268},[267],[13,14913,539],{"className":14914},[180],[13,14916,12328],{"className":14917,"style":12373},[90,91],[13,14919],{"className":14920,"style":12419},[267],[13,14922],{"className":14923,"style":351},[267],[13,14925,14927],{"className":14926},[355],[13,14928,14930],{"className":14929},[90],[13,14931,3045],{"className":14932},[90,922],[13,14934],{"className":14935,"style":12419},[267],[13,14937],{"className":14938,"style":351},[267],[13,14940,3241],{"className":14941},[90],[13,14943,440],{"className":14944},[263],[13,14946],{"className":14947,"style":351},[267],[13,14949,2628],{"className":14950},[355],[13,14952],{"className":14953,"style":351},[267],[13,14955,1230],{"className":14956},[90],[13,14958],{"className":14959,"style":351},[267],[13,14961,780],{"className":14962},[355],[13,14964],{"className":14965,"style":351},[267],[13,14967,14486],{"className":14968},[90],[13,14970,14971,14974],{"style":3426},[13,14972],{"className":14973,"style":206},[205],[13,14975,14977,14980,14983,14986,14989,14995,14998,15004,15059,15062,15065,15068],{"className":14976},[90],[13,14978],{"className":14979},[90],[13,14981],{"className":14982,"style":268},[267],[13,14984,566],{"className":14985},[272],[13,14987],{"className":14988,"style":268},[267],[13,14990,14992],{"className":14991},[90,687],[13,14993,14426],{"className":14994},[90],[13,14996,14510],{"className":14997},[90],[13,14999,15001],{"className":15000},[90,687],[13,15002,14340],{"className":15003},[90],[13,15005,15007,15010],{"className":15006},[90],[13,15008,3262],{"className":15009,"style":4259},[90,91],[13,15011,15013],{"className":15012},[739],[13,15014,15016,15051],{"className":15015},[188,189],[13,15017,15019,15048],{"className":15018},[193],[13,15020,15022],{"className":15021,"style":13904},[197],[13,15023,15024,15027],{"style":4274},[13,15025],{"className":15026,"style":755},[205],[13,15028,15030],{"className":15029},[210,211,212,213],[13,15031,15033,15036,15039,15042],{"className":15032},[90,213],[13,15034,1016],{"className":15035},[90,213],[13,15037,107],{"className":15038,"style":123},[90,91,213],[13,15040,160],{"className":15041},[311,213],[13,15043,15045],{"className":15044},[90,213],[13,15046,13931],{"className":15047},[90,922,213],[13,15049,250],{"className":15050},[249],[13,15052,15054],{"className":15053},[193],[13,15055,15057],{"className":15056,"style":8955},[197],[13,15058],{},[13,15060],{"className":15061,"style":268},[267],[13,15063,566],{"className":15064},[272],[13,15066],{"className":15067,"style":268},[267],[13,15069,1016],{"className":15070},[90],[13,15072,250],{"className":15073},[249],[13,15075,15077],{"className":15076},[193],[13,15078,15080],{"className":15079,"style":3442},[197],[13,15081],{},[10,15083,15084,15085,15113,15114,15315,15316,15344],{},"Because the mantissa ",[13,15086,15088,15101],{"className":15087},[50],[13,15089,15091],{"className":15090},[54],[56,15092,15093],{"xmlns":58},[60,15094,15095,15099],{},[63,15096,15097],{},[66,15098,14495],{},[70,15100,14495],{"encoding":72},[13,15102,15104],{"className":15103,"ariaHidden":77},[76],[13,15105,15107,15110],{"className":15106},[81],[13,15108],{"className":15109,"style":6760},[85],[13,15111,14495],{"className":15112,"style":12373},[90,91]," is zero, the float simplifies to ",[13,15115,15117,15161],{"className":15116},[50],[13,15118,15120],{"className":15119},[54],[56,15121,15122],{"xmlns":58},[60,15123,15124,15158],{},[63,15125,15126,15136,15138,15140,15142,15144,15150,15152],{},[782,15127,15128,15130],{},[66,15129,3262],{},[63,15131,15132,15134],{},[143,15133,1016],{},[66,15135,107],{},[147,15137,566],{},[147,15139,539],{"stretchy":1079},[147,15141,329],{},[143,15143,1085],{},[710,15145,15146,15148],{},[147,15147,440],{"stretchy":1079},[66,15149,3217],{},[147,15151,2628],{},[710,15153,15154,15156],{},[143,15155,145],{},[66,15157,887],{},[70,15159,15160],{"encoding":72},"P_{0y} = (-1)^S \\cdot 2^e",[13,15162,15164,15225,15280],{"className":15163,"ariaHidden":77},[76],[13,15165,15167,15170,15216,15219,15222],{"className":15166},[81],[13,15168],{"className":15169,"style":8910},[85],[13,15171,15173,15176],{"className":15172},[90],[13,15174,3262],{"className":15175,"style":4259},[90,91],[13,15177,15179],{"className":15178},[739],[13,15180,15182,15208],{"className":15181},[188,189],[13,15183,15185,15205],{"className":15184},[193],[13,15186,15188],{"className":15187,"style":828},[197],[13,15189,15190,15193],{"style":4274},[13,15191],{"className":15192,"style":755},[205],[13,15194,15196],{"className":15195},[210,211,212,213],[13,15197,15199,15202],{"className":15198},[90,213],[13,15200,1016],{"className":15201},[90,213],[13,15203,107],{"className":15204,"style":123},[90,91,213],[13,15206,250],{"className":15207},[249],[13,15209,15211],{"className":15210},[193],[13,15212,15214],{"className":15213,"style":8955},[197],[13,15215],{},[13,15217],{"className":15218,"style":268},[267],[13,15220,566],{"className":15221},[272],[13,15223],{"className":15224,"style":268},[267],[13,15226,15228,15232,15235,15238,15241,15271,15274,15277],{"className":15227},[81],[13,15229],{"className":15230,"style":15231},[85],"height:1.0913em;vertical-align:-0.25em;",[13,15233,539],{"className":15234},[180],[13,15236,329],{"className":15237},[90],[13,15239,1085],{"className":15240},[90],[13,15242,15244,15247],{"className":15243},[263],[13,15245,440],{"className":15246},[263],[13,15248,15250],{"className":15249},[739],[13,15251,15253],{"className":15252},[188],[13,15254,15256],{"className":15255},[193],[13,15257,15260],{"className":15258,"style":15259},[197],"height:0.8413em;",[13,15261,15262,15265],{"style":751},[13,15263],{"className":15264,"style":755},[205],[13,15266,15268],{"className":15267},[210,211,212,213],[13,15269,3217],{"className":15270,"style":4198},[90,91,213],[13,15272],{"className":15273,"style":351},[267],[13,15275,2628],{"className":15276},[355],[13,15278],{"className":15279,"style":351},[267],[13,15281,15283,15286],{"className":15282},[81],[13,15284],{"className":15285,"style":6623},[85],[13,15287,15289,15292],{"className":15288},[90],[13,15290,145],{"className":15291},[90],[13,15293,15295],{"className":15294},[739],[13,15296,15298],{"className":15297},[188],[13,15299,15301],{"className":15300},[193],[13,15302,15304],{"className":15303,"style":6623},[197],[13,15305,15306,15309],{"style":751},[13,15307],{"className":15308,"style":755},[205],[13,15310,15312],{"className":15311},[210,211,212,213],[13,15313,887],{"className":15314},[90,91,213],", where the float exponent ",[13,15317,15319,15332],{"className":15318},[50],[13,15320,15322],{"className":15321},[54],[56,15323,15324],{"xmlns":58},[60,15325,15326,15330],{},[63,15327,15328],{},[66,15329,887],{},[70,15331,887],{"encoding":72},[13,15333,15335],{"className":15334,"ariaHidden":77},[76],[13,15336,15338,15341],{"className":15337},[81],[13,15339],{"className":15340,"style":86},[85],[13,15342,887],{"className":15343},[90,91]," is:",[10,15346,15347],{},[13,15348,15350,15406],{"className":15349},[50],[13,15351,15353],{"className":15352},[54],[56,15354,15355],{"xmlns":58},[60,15356,15357,15403],{},[63,15358,15359,15361,15363,15365,15367,15370,15372,15374,15376,15378,15388,15390,15392,15394,15396,15398,15400],{},[66,15360,887],{},[147,15362,566],{},[66,15364,7932],{},[147,15366,329],{},[143,15368,15369],{},"127",[147,15371,566],{},[147,15373,539],{"stretchy":1079},[66,15375,12328],{},[785,15377,12343],{},[147,15379,15380],{"lspace":1070,"rspace":1070},[63,15381,15382,15384,15386],{},[66,15383,2510],{"mathvariant":871},[66,15385,879],{"mathvariant":871},[66,15387,1267],{"mathvariant":871},[785,15389,12343],{},[143,15391,3241],{},[147,15393,440],{"stretchy":1079},[147,15395,2628],{},[143,15397,1230],{},[147,15399,329],{},[143,15401,15402],{},"99",[70,15404,15405],{"encoding":72},"e = E - 127 = (N \\bmod 8) \\cdot 32 - 99",[13,15407,15409,15427,15446,15464,15497,15518,15537],{"className":15408,"ariaHidden":77},[76],[13,15410,15412,15415,15418,15421,15424],{"className":15411},[81],[13,15413],{"className":15414,"style":86},[85],[13,15416,887],{"className":15417},[90,91],[13,15419],{"className":15420,"style":268},[267],[13,15422,566],{"className":15423},[272],[13,15425],{"className":15426,"style":268},[267],[13,15428,15430,15434,15437,15440,15443],{"className":15429},[81],[13,15431],{"className":15432,"style":15433},[85],"height:0.7667em;vertical-align:-0.0833em;",[13,15435,7932],{"className":15436,"style":4198},[90,91],[13,15438],{"className":15439,"style":351},[267],[13,15441,329],{"className":15442},[355],[13,15444],{"className":15445,"style":351},[267],[13,15447,15449,15452,15455,15458,15461],{"className":15448},[81],[13,15450],{"className":15451,"style":12444},[85],[13,15453,15369],{"className":15454},[90],[13,15456],{"className":15457,"style":268},[267],[13,15459,566],{"className":15460},[272],[13,15462],{"className":15463,"style":268},[267],[13,15465,15467,15470,15473,15476,15479,15482,15491,15494],{"className":15466},[81],[13,15468],{"className":15469,"style":6163},[85],[13,15471,539],{"className":15472},[180],[13,15474,12328],{"className":15475,"style":12373},[90,91],[13,15477],{"className":15478,"style":12419},[267],[13,15480],{"className":15481,"style":351},[267],[13,15483,15485],{"className":15484},[355],[13,15486,15488],{"className":15487},[90],[13,15489,3045],{"className":15490},[90,922],[13,15492],{"className":15493,"style":12419},[267],[13,15495],{"className":15496,"style":351},[267],[13,15498,15500,15503,15506,15509,15512,15515],{"className":15499},[81],[13,15501],{"className":15502,"style":6163},[85],[13,15504,3241],{"className":15505},[90],[13,15507,440],{"className":15508},[263],[13,15510],{"className":15511,"style":351},[267],[13,15513,2628],{"className":15514},[355],[13,15516],{"className":15517,"style":351},[267],[13,15519,15521,15525,15528,15531,15534],{"className":15520},[81],[13,15522],{"className":15523,"style":15524},[85],"height:0.7278em;vertical-align:-0.0833em;",[13,15526,1230],{"className":15527},[90],[13,15529],{"className":15530,"style":351},[267],[13,15532,329],{"className":15533},[355],[13,15535],{"className":15536,"style":351},[267],[13,15538,15540,15543],{"className":15539},[81],[13,15541],{"className":15542,"style":12444},[85],[13,15544,15402],{"className":15545},[90],[10,15547,15548,15549,15577,15578,15606,15607,15635],{},"Once the canvas probes measure the exponent ",[13,15550,15552,15565],{"className":15551},[50],[13,15553,15555],{"className":15554},[54],[56,15556,15557],{"xmlns":58},[60,15558,15559,15563],{},[63,15560,15561],{},[66,15562,887],{},[70,15564,887],{"encoding":72},[13,15566,15568],{"className":15567,"ariaHidden":77},[76],[13,15569,15571,15574],{"className":15570},[81],[13,15572],{"className":15573,"style":86},[85],[13,15575,887],{"className":15576},[90,91]," and sign ",[13,15579,15581,15594],{"className":15580},[50],[13,15582,15584],{"className":15583},[54],[56,15585,15586],{"xmlns":58},[60,15587,15588,15592],{},[63,15589,15590],{},[66,15591,3217],{},[70,15593,3217],{"encoding":72},[13,15595,15597],{"className":15596,"ariaHidden":77},[76],[13,15598,15600,15603],{"className":15599},[81],[13,15601],{"className":15602,"style":6760},[85],[13,15604,3217],{"className":15605,"style":4198},[90,91]," (0 for positive, 1 for negative), we can algebraically invert these relations. First, we compute the remainder of ",[13,15608,15610,15623],{"className":15609},[50],[13,15611,15613],{"className":15612},[54],[56,15614,15615],{"xmlns":58},[60,15616,15617,15621],{},[63,15618,15619],{},[66,15620,12328],{},[70,15622,12328],{"encoding":72},[13,15624,15626],{"className":15625,"ariaHidden":77},[76],[13,15627,15629,15632],{"className":15628},[81],[13,15630],{"className":15631,"style":6760},[85],[13,15633,12328],{"className":15634,"style":12373},[90,91]," modulo 8 from the exponent:",[10,15637,15638],{},[13,15639,15641,15687],{"className":15640},[50],[13,15642,15644],{"className":15643},[54],[56,15645,15646],{"xmlns":58},[60,15647,15648,15684],{},[63,15649,15650,15652,15654,15664,15666,15668,15670,15672,15674,15676,15678,15680,15682],{},[66,15651,12328],{},[785,15653,12343],{},[147,15655,15656],{"lspace":1070,"rspace":1070},[63,15657,15658,15660,15662],{},[66,15659,2510],{"mathvariant":871},[66,15661,879],{"mathvariant":871},[66,15663,1267],{"mathvariant":871},[785,15665,12343],{},[143,15667,3241],{},[147,15669,566],{},[147,15671,539],{"stretchy":1079},[66,15673,887],{},[147,15675,780],{},[143,15677,15402],{},[147,15679,440],{"stretchy":1079},[66,15681,14400],{"mathvariant":871},[143,15683,1230],{},[70,15685,15686],{"encoding":72},"N \\bmod 8 = (e + 99) \u002F 32",[13,15688,15690,15720,15738,15759],{"className":15689,"ariaHidden":77},[76],[13,15691,15693,15696,15699,15702,15705,15714,15717],{"className":15692},[81],[13,15694],{"className":15695,"style":8402},[85],[13,15697,12328],{"className":15698,"style":12373},[90,91],[13,15700],{"className":15701,"style":12419},[267],[13,15703],{"className":15704,"style":351},[267],[13,15706,15708],{"className":15707},[355],[13,15709,15711],{"className":15710},[90],[13,15712,3045],{"className":15713},[90,922],[13,15715],{"className":15716,"style":12419},[267],[13,15718],{"className":15719,"style":351},[267],[13,15721,15723,15726,15729,15732,15735],{"className":15722},[81],[13,15724],{"className":15725,"style":12444},[85],[13,15727,3241],{"className":15728},[90],[13,15730],{"className":15731,"style":268},[267],[13,15733,566],{"className":15734},[272],[13,15736],{"className":15737,"style":268},[267],[13,15739,15741,15744,15747,15750,15753,15756],{"className":15740},[81],[13,15742],{"className":15743,"style":6163},[85],[13,15745,539],{"className":15746},[180],[13,15748,887],{"className":15749},[90,91],[13,15751],{"className":15752,"style":351},[267],[13,15754,780],{"className":15755},[355],[13,15757],{"className":15758,"style":351},[267],[13,15760,15762,15765,15768,15771],{"className":15761},[81],[13,15763],{"className":15764,"style":6163},[85],[13,15766,15402],{"className":15767},[90],[13,15769,440],{"className":15770},[263],[13,15772,15774],{"className":15773},[90],"\u002F32",[10,15776,15777,15778,15806,15807,15835],{},"Second, we reconstruct the complete 4-bit value of ",[13,15779,15781,15794],{"className":15780},[50],[13,15782,15784],{"className":15783},[54],[56,15785,15786],{"xmlns":58},[60,15787,15788,15792],{},[63,15789,15790],{},[66,15791,12328],{},[70,15793,12328],{"encoding":72},[13,15795,15797],{"className":15796,"ariaHidden":77},[76],[13,15798,15800,15803],{"className":15799},[81],[13,15801],{"className":15802,"style":6760},[85],[13,15804,12328],{"className":15805,"style":12373},[90,91]," by combining the quotient (",[13,15808,15810,15823],{"className":15809},[50],[13,15811,15813],{"className":15812},[54],[56,15814,15815],{"xmlns":58},[60,15816,15817,15821],{},[63,15818,15819],{},[66,15820,3217],{},[70,15822,3217],{"encoding":72},[13,15824,15826],{"className":15825,"ariaHidden":77},[76],[13,15827,15829,15832],{"className":15828},[81],[13,15830],{"className":15831,"style":6760},[85],[13,15833,3217],{"className":15834,"style":4198},[90,91],") and the remainder:",[10,15837,15838],{},[13,15839,15841,15879],{"className":15840},[50],[13,15842,15844],{"className":15843},[54],[56,15845,15846],{"xmlns":58},[60,15847,15848,15876],{},[63,15849,15850,15852,15854,15856,15858,15860,15862,15864,15866,15868,15870,15872,15874],{},[66,15851,12328],{},[147,15853,566],{},[66,15855,3217],{},[147,15857,2628],{},[143,15859,3241],{},[147,15861,780],{},[147,15863,539],{"stretchy":1079},[66,15865,887],{},[147,15867,780],{},[143,15869,15402],{},[147,15871,440],{"stretchy":1079},[66,15873,14400],{"mathvariant":871},[143,15875,1230],{},[70,15877,15878],{"encoding":72},"N = S \\cdot 8 + (e + 99) \u002F 32",[13,15880,15882,15900,15918,15936,15957],{"className":15881,"ariaHidden":77},[76],[13,15883,15885,15888,15891,15894,15897],{"className":15884},[81],[13,15886],{"className":15887,"style":6760},[85],[13,15889,12328],{"className":15890,"style":12373},[90,91],[13,15892],{"className":15893,"style":268},[267],[13,15895,566],{"className":15896},[272],[13,15898],{"className":15899,"style":268},[267],[13,15901,15903,15906,15909,15912,15915],{"className":15902},[81],[13,15904],{"className":15905,"style":6760},[85],[13,15907,3217],{"className":15908,"style":4198},[90,91],[13,15910],{"className":15911,"style":351},[267],[13,15913,2628],{"className":15914},[355],[13,15916],{"className":15917,"style":351},[267],[13,15919,15921,15924,15927,15930,15933],{"className":15920},[81],[13,15922],{"className":15923,"style":15524},[85],[13,15925,3241],{"className":15926},[90],[13,15928],{"className":15929,"style":351},[267],[13,15931,780],{"className":15932},[355],[13,15934],{"className":15935,"style":351},[267],[13,15937,15939,15942,15945,15948,15951,15954],{"className":15938},[81],[13,15940],{"className":15941,"style":6163},[85],[13,15943,539],{"className":15944},[180],[13,15946,887],{"className":15947},[90,91],[13,15949],{"className":15950,"style":351},[267],[13,15952,780],{"className":15953},[355],[13,15955],{"className":15956,"style":351},[267],[13,15958,15960,15963,15966,15969],{"className":15959},[81],[13,15961],{"className":15962,"style":6163},[85],[13,15964,15402],{"className":15965},[90],[13,15967,440],{"className":15968},[263],[13,15970,15774],{"className":15971},[90],[10,15973,15974,15975,985],{},"Finally, we reverse the constant shift to recover the exact page index ",[13,15976,15978,15991],{"className":15977},[50],[13,15979,15981],{"className":15980},[54],[56,15982,15983],{"xmlns":58},[60,15984,15985,15989],{},[63,15986,15987],{},[66,15988,11809],{},[70,15990,11809],{"encoding":72},[13,15992,15994],{"className":15993,"ariaHidden":77},[76],[13,15995,15997,16000],{"className":15996},[81],[13,15998],{"className":15999,"style":8402},[85],[13,16001,11809],{"className":16002,"style":12042},[90,91],[10,16004,16005],{},[13,16006,16008,16050],{"className":16007},[50],[13,16009,16011],{"className":16010},[54],[56,16012,16013],{"xmlns":58},[60,16014,16015,16047],{},[63,16016,16017,16019,16021,16023,16025,16027,16029,16031,16033,16043,16045],{},[66,16018,11809],{},[147,16020,566],{},[147,16022,539],{"stretchy":1079},[66,16024,12328],{},[147,16026,329],{},[143,16028,10464],{},[147,16030,440],{"stretchy":1079},[785,16032,12343],{},[147,16034,16035],{"lspace":1070,"rspace":1070},[63,16036,16037,16039,16041],{},[66,16038,2510],{"mathvariant":871},[66,16040,879],{"mathvariant":871},[66,16042,1267],{"mathvariant":871},[785,16044,12343],{},[143,16046,790],{},[70,16048,16049],{"encoding":72},"k = (N - 7) \\bmod 16",[13,16051,16053,16071,16092,16125],{"className":16052,"ariaHidden":77},[76],[13,16054,16056,16059,16062,16065,16068],{"className":16055},[81],[13,16057],{"className":16058,"style":8402},[85],[13,16060,11809],{"className":16061,"style":12042},[90,91],[13,16063],{"className":16064,"style":268},[267],[13,16066,566],{"className":16067},[272],[13,16069],{"className":16070,"style":268},[267],[13,16072,16074,16077,16080,16083,16086,16089],{"className":16073},[81],[13,16075],{"className":16076,"style":6163},[85],[13,16078,539],{"className":16079},[180],[13,16081,12328],{"className":16082,"style":12373},[90,91],[13,16084],{"className":16085,"style":351},[267],[13,16087,329],{"className":16088},[355],[13,16090],{"className":16091,"style":351},[267],[13,16093,16095,16098,16101,16104,16107,16110,16119,16122],{"className":16094},[81],[13,16096],{"className":16097,"style":6163},[85],[13,16099,10464],{"className":16100},[90],[13,16102,440],{"className":16103},[263],[13,16105],{"className":16106,"style":12419},[267],[13,16108],{"className":16109,"style":351},[267],[13,16111,16113],{"className":16112},[355],[13,16114,16116],{"className":16115},[90],[13,16117,3045],{"className":16118},[90,922],[13,16120],{"className":16121,"style":12419},[267],[13,16123],{"className":16124,"style":351},[267],[13,16126,16128,16131],{"className":16127},[81],[13,16129],{"className":16130,"style":12444},[85],[13,16132,790],{"className":16133},[90],[10,16135,16136],{},"Reconstructing the 64-bit vtable pointer (vptr) resolves the load base itself. Although ASLR shifts the absolute load address of chrome.so at boot, the internal layout of the compiled library is static. Subtracting the build-constant offset of the vtable (here, 0x0faa7ba0) from the leaked runtime pointer yields the absolute load address (chrome_base), allowing us to locate other interesting symbols (such as mkdir@plt at RVA 0x0f566840) by adding its RVA:",[13,16138,16140],{"className":16139},[989],[13,16141,16143,16284],{"className":16142},[50],[13,16144,16146],{"className":16145},[54],[56,16147,16148],{"xmlns":58,"display":998},[60,16149,16150,16281],{},[1002,16151,16152,16212],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},[1008,16153,16154,16183],{},[1011,16155,16156],{},[1014,16157,16158],{"scriptlevel":1016,"displaystyle":77},[63,16159,16160,16162,16165,16167,16169,16171,16173,16175,16177,16179,16181],{},[66,16161,1272],{"mathvariant":871},[66,16163,16164],{"mathvariant":871},"h",[66,16166,890],{"mathvariant":871},[66,16168,879],{"mathvariant":871},[66,16170,2510],{"mathvariant":871},[66,16172,887],{"mathvariant":871},[66,16174,1030],{"mathvariant":871},[66,16176,1033],{"mathvariant":871},[66,16178,1036],{"mathvariant":871},[66,16180,1039],{"mathvariant":871},[66,16182,887],{"mathvariant":871},[1011,16184,16185],{},[1014,16186,16187],{"scriptlevel":1016,"displaystyle":77},[63,16188,16189,16191,16193,16203,16205],{},[63,16190],{},[147,16192,566],{},[63,16194,16195,16197,16199,16201],{},[66,16196,2567],{"mathvariant":871},[66,16198,10],{"mathvariant":871},[66,16200,1194],{"mathvariant":871},[66,16202,890],{"mathvariant":871},[147,16204,329],{},[782,16206,16207,16210],{},[785,16208,16209],{},"0FAA7BA0",[143,16211,790],{},[1008,16213,16214,16238],{},[1011,16215,16216],{},[1014,16217,16218],{"scriptlevel":1016,"displaystyle":77},[63,16219,16220,16222,16224,16226,16228,16230,16232,16234,16236],{},[66,16221,2510],{"mathvariant":871},[66,16223,11809],{"mathvariant":871},[66,16225,1267],{"mathvariant":871},[66,16227,2521],{"mathvariant":871},[66,16229,890],{"mathvariant":871},[66,16231,1030],{"mathvariant":871},[66,16233,1036],{"mathvariant":871},[66,16235,1033],{"mathvariant":871},[66,16237,1039],{"mathvariant":871},[1011,16239,16240],{},[1014,16241,16242],{"scriptlevel":1016,"displaystyle":77},[63,16243,16244,16246,16248,16272,16274],{},[63,16245],{},[147,16247,566],{},[63,16249,16250,16252,16254,16256,16258,16260,16262,16264,16266,16268,16270],{},[66,16251,1272],{"mathvariant":871},[66,16253,16164],{"mathvariant":871},[66,16255,890],{"mathvariant":871},[66,16257,879],{"mathvariant":871},[66,16259,2510],{"mathvariant":871},[66,16261,887],{"mathvariant":871},[66,16263,1030],{"mathvariant":871},[66,16265,1033],{"mathvariant":871},[66,16267,1036],{"mathvariant":871},[66,16269,1039],{"mathvariant":871},[66,16271,887],{"mathvariant":871},[147,16273,780],{},[782,16275,16276,16279],{},[785,16277,16278],{},"0F566840",[143,16280,790],{},[70,16282,16283],{"encoding":72},"\\begin{aligned}\n\\mathrm{chrome\\_base} &= \\mathrm{vptr} - \\text{0FAA7BA0}_{16} \\\\\n\\mathrm{mkdir\\_abs} &= \\mathrm{chrome\\_base} + \\text{0F566840}_{16}\n\\end{aligned}",[13,16285,16287],{"className":16286,"ariaHidden":77},[76],[13,16288,16290,16293],{"className":16289},[81],[13,16291],{"className":16292,"style":10592},[85],[13,16294,16296],{"className":16295},[90],[13,16297,16299,16352],{"className":16298},[1002],[13,16300,16302],{"className":16301},[1363],[13,16303,16305,16344],{"className":16304},[188,189],[13,16306,16308,16341],{"className":16307},[193],[13,16309,16311,16326],{"className":16310,"style":10611},[197],[13,16312,16313,16316],{"style":10614},[13,16314],{"className":16315,"style":206},[205],[13,16317,16319],{"className":16318},[90],[13,16320,16322],{"className":16321},[90],[13,16323,16325],{"className":16324},[90,922],"chrome_base",[13,16327,16328,16331],{"style":10669},[13,16329],{"className":16330,"style":206},[205],[13,16332,16334],{"className":16333},[90],[13,16335,16337],{"className":16336},[90],[13,16338,16340],{"className":16339},[90,922],"mkdir_abs",[13,16342,250],{"className":16343},[249],[13,16345,16347],{"className":16346},[193],[13,16348,16350],{"className":16349,"style":10685},[197],[13,16351],{},[13,16353,16355],{"className":16354},[1456],[13,16356,16358,16529],{"className":16357},[188,189],[13,16359,16361,16526],{"className":16360},[193],[13,16362,16364,16445],{"className":16363,"style":10611},[197],[13,16365,16366,16369],{"style":10614},[13,16367],{"className":16368,"style":206},[205],[13,16370,16372,16375,16378,16381,16384,16390,16393,16396,16399],{"className":16371},[90],[13,16373],{"className":16374},[90],[13,16376],{"className":16377,"style":268},[267],[13,16379,566],{"className":16380},[272],[13,16382],{"className":16383,"style":268},[267],[13,16385,16387],{"className":16386},[90],[13,16388,8744],{"className":16389},[90,922],[13,16391],{"className":16392,"style":351},[267],[13,16394,329],{"className":16395},[355],[13,16397],{"className":16398,"style":351},[267],[13,16400,16402,16408],{"className":16401},[90],[13,16403,16405],{"className":16404},[90,687],[13,16406,16209],{"className":16407},[90],[13,16409,16411],{"className":16410},[739],[13,16412,16414,16437],{"className":16413},[188,189],[13,16415,16417,16434],{"className":16416},[193],[13,16418,16420],{"className":16419,"style":828},[197],[13,16421,16422,16425],{"style":831},[13,16423],{"className":16424,"style":755},[205],[13,16426,16428],{"className":16427},[210,211,212,213],[13,16429,16431],{"className":16430},[90,213],[13,16432,790],{"className":16433},[90,213],[13,16435,250],{"className":16436},[249],[13,16438,16440],{"className":16439},[193],[13,16441,16443],{"className":16442,"style":853},[197],[13,16444],{},[13,16446,16447,16450],{"style":10669},[13,16448],{"className":16449,"style":206},[205],[13,16451,16453,16456,16459,16462,16465,16471,16474,16477,16480],{"className":16452},[90],[13,16454],{"className":16455},[90],[13,16457],{"className":16458,"style":268},[267],[13,16460,566],{"className":16461},[272],[13,16463],{"className":16464,"style":268},[267],[13,16466,16468],{"className":16467},[90],[13,16469,16325],{"className":16470},[90,922],[13,16472],{"className":16473,"style":351},[267],[13,16475,780],{"className":16476},[355],[13,16478],{"className":16479,"style":351},[267],[13,16481,16483,16489],{"className":16482},[90],[13,16484,16486],{"className":16485},[90,687],[13,16487,16278],{"className":16488},[90],[13,16490,16492],{"className":16491},[739],[13,16493,16495,16518],{"className":16494},[188,189],[13,16496,16498,16515],{"className":16497},[193],[13,16499,16501],{"className":16500,"style":828},[197],[13,16502,16503,16506],{"style":831},[13,16504],{"className":16505,"style":755},[205],[13,16507,16509],{"className":16508},[210,211,212,213],[13,16510,16512],{"className":16511},[90,213],[13,16513,790],{"className":16514},[90,213],[13,16516,250],{"className":16517},[249],[13,16519,16521],{"className":16520},[193],[13,16522,16524],{"className":16523,"style":853},[197],[13,16525],{},[13,16527,250],{"className":16528},[249],[13,16530,16532],{"className":16531},[193],[13,16533,16535],{"className":16534,"style":10685},[197],[13,16536],{},[42,16538,16540],{"label":16539},"Completely honest",[10,16541,16542],{},"I prompted an AI to do the math for me. It worked. Tested with our PoC, not pure slop.",[10,16544,16545],{},"With the arbitrary write (forge) primitive and the leaked base addresses (heap pool base and chrome code base), we can now proceed to execute code.",[29,16547,16549],{"id":16548},"the-arb-call","The Arb-Call",[10,16551,16552],{},"The forge primitive gives us a controlled write into the GPU process heap. To turn that into code execution we need an indirect call site where the function pointer is attacker-writable and the call is not guarded by CFI.",[449,16554,16556],{"id":16555},"target-properties","Target properties",[10,16558,16559],{},"So we hunt for a heap structure with four specific properties:",[466,16561,16562,16568,16574,16580],{},[413,16563,16564,16567],{},[37,16565,16566],{},"Address predictability",": we must be able to locate it (either via a stable static pool offset or a dynamic heap walk).",[413,16569,16570,16573],{},[37,16571,16572],{},"Function tables",": it must contain function pointers that are called during routine execution (so we can trigger our hijack).",[413,16575,16576,16579],{},[37,16577,16578],{},"CFI exemption",": calls through these pointers are not guarded by CFI.",[413,16581,16582,16585],{},[37,16583,16584],{},"Safe free path",": we must be able to free it (to put its slot back on the freelist) and reclaim it with our own payload.",[10,16587,16588],{},"GrGLInterface (Skia's OpenGL function table) fits this profile well.",[449,16590,16592],{"id":16591},"why-grglinterface-bypasses-cfi","Why GrGLInterface bypasses CFI",[10,16594,16595],{},"GrGLInterface is Skia's OpenGL function-pointer table. The GPU calls through its entries on every GL operation.",[10,16597,16598],{},"While LLVM CFI's cfi-icall normally instruments indirect call sites to verify function signatures, the GrGLFunction call family is explicitly excluded in src\u002Ftools\u002Fcfi\u002Fignores.txt:",[508,16600,16603],{"className":16601,"code":16602,"language":687,"meta":513},[685],"# third_party\u002Fskia\u002Finclude\u002Fgpu\u002Fgl\u002FGrGLFunctions.h\nfun:*GrGLFunction*\n",[437,16604,16602],{"__ignoreMap":513},[10,16606,16607,16608,16611],{},"This exclusion is necessary because chromium loads GL function pointers at runtime via eglGetProcAddress() \u002F glXGetProcAddress(). Since the actual types are determined by the GL driver rather than compile-time information, CFI cannot validate them, and calls through ",[437,16609,16610],{},"GrGLFunction\u003C>"," are compiled without checks.",[487,16613,16614],{"type":489},[10,16615,16616],{},"GrGLFunction calls are excluded from CFI because GL pointers are loaded at runtime from the driver. Overwriting GrGLInterface gives us a CFI-free indirect call gate on the heap.",[449,16618,16620],{"id":16619},"locating-the-target-static-offset","Locating the target (static offset)",[10,16622,16623],{},"GrGLInterface is allocated once during GPU process initialization, before any user rasterization traffic. Because the startup allocation sequence is highly deterministic for a given environment, this allocation lands at a \"stable\" offset within PartitionAlloc's pool.",[10,16625,16626],{},"However, this static offset is environment-dependent: it varies across different browser builds, compiler flags, and operating systems. In the target environment of this build, the GrGLInterface singleton sits at a constant pool offset from the leaked heap base:",[10,16628,16629],{},[13,16630,16632,16708],{"className":16631},[50],[13,16633,16635],{"className":16634},[54],[56,16636,16637],{"xmlns":58},[60,16638,16639,16705],{},[63,16640,16641,16643,16674,16676,16696,16698],{},[66,16642,617],{"mathvariant":871},[63,16644,16645,16648,16650,16652,16654,16657,16659,16661,16663,16665,16668,16670,16672],{},[66,16646,16647],{"mathvariant":871},"G",[66,16649,890],{"mathvariant":871},[66,16651,16647],{"mathvariant":871},[66,16653,876],{"mathvariant":871},[66,16655,16656],{"mathvariant":871},"I",[66,16658,2526],{"mathvariant":871},[66,16660,1194],{"mathvariant":871},[66,16662,887],{"mathvariant":871},[66,16664,890],{"mathvariant":871},[66,16666,16667],{"mathvariant":871},"f",[66,16669,1036],{"mathvariant":871},[66,16671,1272],{"mathvariant":871},[66,16673,887],{"mathvariant":871},[147,16675,566],{},[63,16677,16678,16680,16682,16684,16686,16688,16690,16692,16694],{},[66,16679,10],{"mathvariant":871},[66,16681,879],{"mathvariant":871},[66,16683,879],{"mathvariant":871},[66,16685,1027],{"mathvariant":871},[66,16687,1030],{"mathvariant":871},[66,16689,1033],{"mathvariant":871},[66,16691,1036],{"mathvariant":871},[66,16693,1039],{"mathvariant":871},[66,16695,887],{"mathvariant":871},[147,16697,780],{},[782,16699,16700,16703],{},[785,16701,16702],{},"4008EA800",[143,16704,790],{},[70,16706,16707],{"encoding":72},"\\&\\mathrm{GrGLInterface} = \\mathrm{pool\\_base} + \\text{4008EA800}_{16}",[13,16709,16711,16736,16758],{"className":16710,"ariaHidden":77},[76],[13,16712,16714,16717,16720,16727,16730,16733],{"className":16713},[81],[13,16715],{"className":16716,"style":8402},[85],[13,16718,617],{"className":16719},[90],[13,16721,16723],{"className":16722},[90],[13,16724,16726],{"className":16725},[90,922],"GrGLInterface",[13,16728],{"className":16729,"style":268},[267],[13,16731,566],{"className":16732},[272],[13,16734],{"className":16735,"style":268},[267],[13,16737,16739,16743,16749,16752,16755],{"className":16738},[81],[13,16740],{"className":16741,"style":16742},[85],"height:1.0044em;vertical-align:-0.31em;",[13,16744,16746],{"className":16745},[90],[13,16747,1389],{"className":16748},[90,922],[13,16750],{"className":16751,"style":351},[267],[13,16753,780],{"className":16754},[355],[13,16756],{"className":16757,"style":351},[267],[13,16759,16761,16764],{"className":16760},[81],[13,16762],{"className":16763,"style":938},[85],[13,16765,16767,16773],{"className":16766},[90],[13,16768,16770],{"className":16769},[90,687],[13,16771,16702],{"className":16772},[90],[13,16774,16776],{"className":16775},[739],[13,16777,16779,16802],{"className":16778},[188,189],[13,16780,16782,16799],{"className":16781},[193],[13,16783,16785],{"className":16784,"style":828},[197],[13,16786,16787,16790],{"style":831},[13,16788],{"className":16789,"style":755},[205],[13,16791,16793],{"className":16792},[210,211,212,213],[13,16794,16796],{"className":16795},[90,213],[13,16797,790],{"className":16798},[90,213],[13,16800,250],{"className":16801},[249],[13,16803,16805],{"className":16804},[193],[13,16806,16808],{"className":16807,"style":853},[197],[13,16809],{},[487,16811,16813],{"type":16812},"bunny",[10,16814,16815],{},"Wait, what if we want an environment-independent solution? Don't panic — jump hoops, walk the heap (see the dynamic-walk section below).",[10,16817,16818],{},"With the target address resolved, we can now proceed to hijack it.",[449,16820,16822],{"id":16821},"the-free-reclaim","The free + reclaim",[10,16824,16825],{},"Our goal is to free GrGLInterface and immediately reclaim its slot with a controlled payload. Because the GPU process maintains a live pointer to this structure and continuously calls GL functions through it, overwriting this memory block allows us to intercept the next GL call and hijack execution.",[10,16827,16828],{},"First, we plant AF = &GrGLInterface into the victim's listener-array data pointer (the UAF target from the dual-use corruption above). Evicting the victim triggers the destructor cascade, freeing the interface:",[508,16830,16833],{"className":16831,"code":16832,"language":687,"meta":513},[685],"ring.clearPaintCache() -> ~SkPathData() -> sk_free(&GrGLInterface)\n",[437,16834,16832],{"__ignoreMap":513},[10,16836,16837],{},"GrGLInterface is an 8,240-byte object that lands in the multi-slot bucket-10240. When freed, its slot returns to that bucket's LIFO freelist. Within the same IPC batch, we reclaim the slot by allocating 64 same-sized transfer-cache entries (kTCRawMemory) filled with our payload. Because the freelist is LIFO, the first allocation pops the GrGLInterface slot we just freed and overwrites it with our payload. Spraying 64 allocations ensures we win the slot even if background thread activity creates noise.",[449,16839,16841],{"id":16840},"payload-layout-and-execution-dispatch","Payload layout and execution dispatch",[10,16843,16844],{},"GrGLInterface consists of a header followed by an array of GrGLFunction entry wrappers. Each wrapper contains an invoker function pointer (fCall) and a local buffer (fBuf) for closure storage:",[508,16846,16848],{"className":510,"code":16847,"language":512,"meta":513,"style":513},"struct GrGLFunction {\n    void* fCall;\n    char  fBuf[32];\n};\n",[437,16849,16850,16861,16868,16881],{"__ignoreMap":513},[13,16851,16852,16855,16858],{"class":518,"line":519},[13,16853,16854],{"class":542},"struct",[13,16856,16857],{"class":529}," GrGLFunction",[13,16859,16860],{"class":533}," {\n",[13,16862,16863,16865],{"class":518,"line":526},[13,16864,3852],{"class":542},[13,16866,16867],{"class":533}," fCall;\n",[13,16869,16870,16873,16876,16878],{"class":518,"line":555},[13,16871,16872],{"class":542},"    char",[13,16874,16875],{"class":533},"  fBuf[",[13,16877,1230],{"class":569},[13,16879,16880],{"class":533},"];\n",[13,16882,16883],{"class":518,"line":576},[13,16884,16885],{"class":533},"};\n",[10,16887,16888],{},"Invoking any entry calls fCall(fBuf, args...). Because the invoker is always handed the address of fBuf as its first argument, we can hijack execution by pointing fCall to mkdir@plt and putting the string \"\u002Ftmp\u002Fpwned\" in fBuf.",[10,16890,16891],{},"To ensure this works regardless of which GL function Skia calls next, we tile this fake entry pattern across the entire reclaimed slot, zeroing out the header. When the GPU triggers the next GL call, the x86-64 SysV ABI passes the first argument (the address of fBuf, i.e., \"\u002Ftmp\u002Fpwned\") in rdi. This transforms the dispatch into a direct call:",[508,16893,16896],{"className":16894,"code":16895,"language":687,"meta":513},[685],"mkdir(\"\u002Ftmp\u002Fpwned\", mode)\n",[437,16897,16895],{"__ignoreMap":513},[10,16899,16900],{},"Since mkdir ignores any subsequent arguments, the directory is successfully created and code execution is achieved.",[42,16902,16903],{},[10,16904,16905],{},"mkdir is just a non-destructive sandbox escape demo to prove code execution. A real payload would require rop\u002Fshellcode, which is left as an exercise.",[29,16907,16909],{"id":16908},"chasing-pointers-the-dynamic-walk","Chasing pointers: the dynamic walk",[10,16911,16912],{},"Recall our progress: the c1read primitive bypassed code ASLR by reading coordinate floats from the double-vtable to locate mkdir@plt, and the Arb-Call section established our arbitrary call mechanics. However, the static offset shortcut above is highly environment-dependent. If the driver or operating system changes, the offset drifts, and we lack a generic method to locate the GrGLInterface address on the heap.",[42,16914,16915],{"bunny":77},[10,16916,16917],{},"Follow the heap pointers, Neo.",[10,16919,16920],{},"To resolve this dynamically, we must trace the GPU's internal object graph starting from our leaked decoder base. Doing so requires the ability to read arbitrary pointers from the heap, not just the special double-vtable layout.",[449,16922,16924],{"id":16923},"general-pointer-reads-and-zero-framing-zazb","General pointer reads and Zero Framing (ZA\u002FZB)",[10,16926,16927,16928,16931],{},"To perform this walk, we need to read arbitrary 64-bit pointers. While our ASLR leak (the vptr section above) read a specific vptr that naturally came with a twin (vptr2), a general pointer ",[437,16929,16930],{},"*T"," at location T has no neighboring twin; its adjacent 8 bytes contain unrelated heap data.",[10,16933,16934,16935,92,17153,17370],{},"This presents a major measurement problem. When Skia renders a line between two points ",[13,16936,16938,16984],{"className":16937},[50],[13,16939,16941],{"className":16940},[54],[56,16942,16943],{"xmlns":58},[60,16944,16945,16981],{},[63,16946,16947,16953,16955,16957,16967,16969,16979],{},[782,16948,16949,16951],{},[66,16950,3262],{},[143,16952,1016],{},[147,16954,566],{},[147,16956,539],{"stretchy":1079},[782,16958,16959,16961],{},[66,16960,3262],{},[63,16962,16963,16965],{},[143,16964,1016],{},[66,16966,68],{},[147,16968,160],{"separator":77},[782,16970,16971,16973],{},[66,16972,3262],{},[63,16974,16975,16977],{},[143,16976,1016],{},[66,16978,107],{},[147,16980,440],{"stretchy":1079},[70,16982,16983],{"encoding":72},"P_0 = (P_{0x}, P_{0y})",[13,16985,16987,17042],{"className":16986,"ariaHidden":77},[76],[13,16988,16990,16993,17033,17036,17039],{"className":16989},[81],[13,16991],{"className":16992,"style":938},[85],[13,16994,16996,16999],{"className":16995},[90],[13,16997,3262],{"className":16998,"style":4259},[90,91],[13,17000,17002],{"className":17001},[739],[13,17003,17005,17025],{"className":17004},[188,189],[13,17006,17008,17022],{"className":17007},[193],[13,17009,17011],{"className":17010,"style":828},[197],[13,17012,17013,17016],{"style":4274},[13,17014],{"className":17015,"style":755},[205],[13,17017,17019],{"className":17018},[210,211,212,213],[13,17020,1016],{"className":17021},[90,213],[13,17023,250],{"className":17024},[249],[13,17026,17028],{"className":17027},[193],[13,17029,17031],{"className":17030,"style":853},[197],[13,17032],{},[13,17034],{"className":17035,"style":268},[267],[13,17037,566],{"className":17038},[272],[13,17040],{"className":17041,"style":268},[267],[13,17043,17045,17049,17052,17098,17101,17104,17150],{"className":17044},[81],[13,17046],{"className":17047,"style":17048},[85],"height:1.0361em;vertical-align:-0.2861em;",[13,17050,539],{"className":17051},[180],[13,17053,17055,17058],{"className":17054},[90],[13,17056,3262],{"className":17057,"style":4259},[90,91],[13,17059,17061],{"className":17060},[739],[13,17062,17064,17090],{"className":17063},[188,189],[13,17065,17067,17087],{"className":17066},[193],[13,17068,17070],{"className":17069,"style":828},[197],[13,17071,17072,17075],{"style":4274},[13,17073],{"className":17074,"style":755},[205],[13,17076,17078],{"className":17077},[210,211,212,213],[13,17079,17081,17084],{"className":17080},[90,213],[13,17082,1016],{"className":17083},[90,213],[13,17085,68],{"className":17086},[90,91,213],[13,17088,250],{"className":17089},[249],[13,17091,17093],{"className":17092},[193],[13,17094,17096],{"className":17095,"style":853},[197],[13,17097],{},[13,17099,160],{"className":17100},[311],[13,17102],{"className":17103,"style":8430},[267],[13,17105,17107,17110],{"className":17106},[90],[13,17108,3262],{"className":17109,"style":4259},[90,91],[13,17111,17113],{"className":17112},[739],[13,17114,17116,17142],{"className":17115},[188,189],[13,17117,17119,17139],{"className":17118},[193],[13,17120,17122],{"className":17121,"style":828},[197],[13,17123,17124,17127],{"style":4274},[13,17125],{"className":17126,"style":755},[205],[13,17128,17130],{"className":17129},[210,211,212,213],[13,17131,17133,17136],{"className":17132},[90,213],[13,17134,1016],{"className":17135},[90,213],[13,17137,107],{"className":17138,"style":123},[90,91,213],[13,17140,250],{"className":17141},[249],[13,17143,17145],{"className":17144},[193],[13,17146,17148],{"className":17147,"style":8955},[197],[13,17149],{},[13,17151,440],{"className":17152},[263],[13,17154,17156,17202],{"className":17155},[50],[13,17157,17159],{"className":17158},[54],[56,17160,17161],{"xmlns":58},[60,17162,17163,17199],{},[63,17164,17165,17171,17173,17175,17185,17187,17197],{},[782,17166,17167,17169],{},[66,17168,3262],{},[143,17170,1085],{},[147,17172,566],{},[147,17174,539],{"stretchy":1079},[782,17176,17177,17179],{},[66,17178,3262],{},[63,17180,17181,17183],{},[143,17182,1085],{},[66,17184,68],{},[147,17186,160],{"separator":77},[782,17188,17189,17191],{},[66,17190,3262],{},[63,17192,17193,17195],{},[143,17194,1085],{},[66,17196,107],{},[147,17198,440],{"stretchy":1079},[70,17200,17201],{"encoding":72},"P_1 = (P_{1x}, P_{1y})",[13,17203,17205,17260],{"className":17204,"ariaHidden":77},[76],[13,17206,17208,17211,17251,17254,17257],{"className":17207},[81],[13,17209],{"className":17210,"style":938},[85],[13,17212,17214,17217],{"className":17213},[90],[13,17215,3262],{"className":17216,"style":4259},[90,91],[13,17218,17220],{"className":17219},[739],[13,17221,17223,17243],{"className":17222},[188,189],[13,17224,17226,17240],{"className":17225},[193],[13,17227,17229],{"className":17228,"style":828},[197],[13,17230,17231,17234],{"style":4274},[13,17232],{"className":17233,"style":755},[205],[13,17235,17237],{"className":17236},[210,211,212,213],[13,17238,1085],{"className":17239},[90,213],[13,17241,250],{"className":17242},[249],[13,17244,17246],{"className":17245},[193],[13,17247,17249],{"className":17248,"style":853},[197],[13,17250],{},[13,17252],{"className":17253,"style":268},[267],[13,17255,566],{"className":17256},[272],[13,17258],{"className":17259,"style":268},[267],[13,17261,17263,17266,17269,17315,17318,17321,17367],{"className":17262},[81],[13,17264],{"className":17265,"style":17048},[85],[13,17267,539],{"className":17268},[180],[13,17270,17272,17275],{"className":17271},[90],[13,17273,3262],{"className":17274,"style":4259},[90,91],[13,17276,17278],{"className":17277},[739],[13,17279,17281,17307],{"className":17280},[188,189],[13,17282,17284,17304],{"className":17283},[193],[13,17285,17287],{"className":17286,"style":828},[197],[13,17288,17289,17292],{"style":4274},[13,17290],{"className":17291,"style":755},[205],[13,17293,17295],{"className":17294},[210,211,212,213],[13,17296,17298,17301],{"className":17297},[90,213],[13,17299,1085],{"className":17300},[90,213],[13,17302,68],{"className":17303},[90,91,213],[13,17305,250],{"className":17306},[249],[13,17308,17310],{"className":17309},[193],[13,17311,17313],{"className":17312,"style":853},[197],[13,17314],{},[13,17316,160],{"className":17317},[311],[13,17319],{"className":17320,"style":8430},[267],[13,17322,17324,17327],{"className":17323},[90],[13,17325,3262],{"className":17326,"style":4259},[90,91],[13,17328,17330],{"className":17329},[739],[13,17331,17333,17359],{"className":17332},[188,189],[13,17334,17336,17356],{"className":17335},[193],[13,17337,17339],{"className":17338,"style":828},[197],[13,17340,17341,17344],{"style":4274},[13,17342],{"className":17343,"style":755},[205],[13,17345,17347],{"className":17346},[210,211,212,213],[13,17348,17350,17353],{"className":17349},[90,213],[13,17351,1085],{"className":17352},[90,213],[13,17354,107],{"className":17355,"style":123},[90,91,213],[13,17357,250],{"className":17358},[249],[13,17360,17362],{"className":17361},[193],[13,17363,17365],{"className":17364,"style":8955},[197],[13,17366],{},[13,17368,440],{"className":17369},[263],", the screen coordinates are mapped using scale (S) and translation (T):",[13,17372,17374],{"className":17373},[989],[13,17375,17377,17505],{"className":17376},[50],[13,17378,17380],{"className":17379},[54],[56,17381,17382],{"xmlns":58,"display":998},[60,17383,17384,17502],{},[1002,17385,17386,17444],{"rowspacing":1004,"columnalign":3190,"columnspacing":3191},[1008,17387,17388,17406],{},[1011,17389,17390],{},[1014,17391,17392],{"scriptlevel":1016,"displaystyle":77},[63,17393,17394,17400,17402,17404],{},[782,17395,17396,17398],{},[66,17397,4100],{},[66,17399,68],{},[147,17401,8716],{"stretchy":1079},[66,17403,2521],{},[147,17405,8722],{"stretchy":1079},[1011,17407,17408],{},[1014,17409,17410],{"scriptlevel":1016,"displaystyle":77},[63,17411,17412,17414,17416,17422,17424,17426,17428,17430,17432,17434,17436,17438],{},[63,17413],{},[147,17415,566],{},[782,17417,17418,17420],{},[66,17419,3217],{},[66,17421,68],{},[785,17423,7923],{},[66,17425,3262],{},[147,17427,8716],{"stretchy":1079},[66,17429,2521],{},[147,17431,8722],{"stretchy":1079},[66,17433,5739],{"mathvariant":871},[66,17435,68],{},[147,17437,780],{},[782,17439,17440,17442],{},[66,17441,17],{},[66,17443,68],{},[1008,17445,17446,17464],{},[1011,17447,17448],{},[1014,17449,17450],{"scriptlevel":1016,"displaystyle":77},[63,17451,17452,17458,17460,17462],{},[782,17453,17454,17456],{},[66,17455,4100],{},[66,17457,107],{},[147,17459,8716],{"stretchy":1079},[66,17461,2521],{},[147,17463,8722],{"stretchy":1079},[1011,17465,17466],{},[1014,17467,17468],{"scriptlevel":1016,"displaystyle":77},[63,17469,17470,17472,17474,17480,17482,17484,17486,17488,17490,17492,17494,17496],{},[63,17471],{},[147,17473,566],{},[782,17475,17476,17478],{},[66,17477,3217],{},[66,17479,107],{},[785,17481,7923],{},[66,17483,3262],{},[147,17485,8716],{"stretchy":1079},[66,17487,2521],{},[147,17489,8722],{"stretchy":1079},[66,17491,5739],{"mathvariant":871},[66,17493,107],{},[147,17495,780],{},[782,17497,17498,17500],{},[66,17499,17],{},[66,17501,107],{},[70,17503,17504],{"encoding":72},"\\begin{aligned}\nD_x[i] &= S_x \\, P[i].x + T_x \\\\\nD_y[i] &= S_y \\, P[i].y + T_y\n\\end{aligned}",[13,17506,17508],{"className":17507,"ariaHidden":77},[76],[13,17509,17511,17514],{"className":17510},[81],[13,17512],{"className":17513,"style":10592},[85],[13,17515,17517],{"className":17516},[90],[13,17518,17520,17657],{"className":17519},[1002],[13,17521,17523],{"className":17522},[1363],[13,17524,17526,17649],{"className":17525},[188,189],[13,17527,17529,17646],{"className":17528},[193],[13,17530,17532,17589],{"className":17531,"style":10611},[197],[13,17533,17534,17537],{"style":10614},[13,17535],{"className":17536,"style":206},[205],[13,17538,17540,17580,17583,17586],{"className":17539},[90],[13,17541,17543,17546],{"className":17542},[90],[13,17544,4100],{"className":17545,"style":4140},[90,91],[13,17547,17549],{"className":17548},[739],[13,17550,17552,17572],{"className":17551},[188,189],[13,17553,17555,17569],{"className":17554},[193],[13,17556,17558],{"className":17557,"style":4153},[197],[13,17559,17560,17563],{"style":4156},[13,17561],{"className":17562,"style":755},[205],[13,17564,17566],{"className":17565},[210,211,212,213],[13,17567,68],{"className":17568},[90,91,213],[13,17570,250],{"className":17571},[249],[13,17573,17575],{"className":17574},[193],[13,17576,17578],{"className":17577,"style":853},[197],[13,17579],{},[13,17581,8716],{"className":17582},[180],[13,17584,2521],{"className":17585},[90,91],[13,17587,8722],{"className":17588},[263],[13,17590,17591,17594],{"style":10669},[13,17592],{"className":17593,"style":206},[205],[13,17595,17597,17637,17640,17643],{"className":17596},[90],[13,17598,17600,17603],{"className":17599},[90],[13,17601,4100],{"className":17602,"style":4140},[90,91],[13,17604,17606],{"className":17605},[739],[13,17607,17609,17629],{"className":17608},[188,189],[13,17610,17612,17626],{"className":17611},[193],[13,17613,17615],{"className":17614,"style":4153},[197],[13,17616,17617,17620],{"style":4156},[13,17618],{"className":17619,"style":755},[205],[13,17621,17623],{"className":17622},[210,211,212,213],[13,17624,107],{"className":17625,"style":123},[90,91,213],[13,17627,250],{"className":17628},[249],[13,17630,17632],{"className":17631},[193],[13,17633,17635],{"className":17634,"style":8955},[197],[13,17636],{},[13,17638,8716],{"className":17639},[180],[13,17641,2521],{"className":17642},[90,91],[13,17644,8722],{"className":17645},[263],[13,17647,250],{"className":17648},[249],[13,17650,17652],{"className":17651},[193],[13,17653,17655],{"className":17654,"style":10685},[197],[13,17656],{},[13,17658,17660],{"className":17659},[1456],[13,17661,17663,17932],{"className":17662},[188,189],[13,17664,17666,17929],{"className":17665},[193],[13,17667,17669,17799],{"className":17668,"style":10611},[197],[13,17670,17671,17674],{"style":10614},[13,17672],{"className":17673,"style":206},[205],[13,17675,17677,17680,17683,17686,17689,17729,17732,17735,17738,17741,17744,17747,17750,17753,17756,17759],{"className":17676},[90],[13,17678],{"className":17679},[90],[13,17681],{"className":17682,"style":268},[267],[13,17684,566],{"className":17685},[272],[13,17687],{"className":17688,"style":268},[267],[13,17690,17692,17695],{"className":17691},[90],[13,17693,3217],{"className":17694,"style":4198},[90,91],[13,17696,17698],{"className":17697},[739],[13,17699,17701,17721],{"className":17700},[188,189],[13,17702,17704,17718],{"className":17703},[193],[13,17705,17707],{"className":17706,"style":4153},[197],[13,17708,17709,17712],{"style":4213},[13,17710],{"className":17711,"style":755},[205],[13,17713,17715],{"className":17714},[210,211,212,213],[13,17716,68],{"className":17717},[90,91,213],[13,17719,250],{"className":17720},[249],[13,17722,17724],{"className":17723},[193],[13,17725,17727],{"className":17726,"style":853},[197],[13,17728],{},[13,17730],{"className":17731,"style":8430},[267],[13,17733,3262],{"className":17734,"style":4259},[90,91],[13,17736,8716],{"className":17737},[180],[13,17739,2521],{"className":17740},[90,91],[13,17742,8722],{"className":17743},[263],[13,17745,5739],{"className":17746},[90],[13,17748,68],{"className":17749},[90,91],[13,17751],{"className":17752,"style":351},[267],[13,17754,780],{"className":17755},[355],[13,17757],{"className":17758,"style":351},[267],[13,17760,17762,17765],{"className":17761},[90],[13,17763,17],{"className":17764,"style":4259},[90,91],[13,17766,17768],{"className":17767},[739],[13,17769,17771,17791],{"className":17770},[188,189],[13,17772,17774,17788],{"className":17773},[193],[13,17775,17777],{"className":17776,"style":4153},[197],[13,17778,17779,17782],{"style":4274},[13,17780],{"className":17781,"style":755},[205],[13,17783,17785],{"className":17784},[210,211,212,213],[13,17786,68],{"className":17787},[90,91,213],[13,17789,250],{"className":17790},[249],[13,17792,17794],{"className":17793},[193],[13,17795,17797],{"className":17796,"style":853},[197],[13,17798],{},[13,17800,17801,17804],{"style":10669},[13,17802],{"className":17803,"style":206},[205],[13,17805,17807,17810,17813,17816,17819,17859,17862,17865,17868,17871,17874,17877,17880,17883,17886,17889],{"className":17806},[90],[13,17808],{"className":17809},[90],[13,17811],{"className":17812,"style":268},[267],[13,17814,566],{"className":17815},[272],[13,17817],{"className":17818,"style":268},[267],[13,17820,17822,17825],{"className":17821},[90],[13,17823,3217],{"className":17824,"style":4198},[90,91],[13,17826,17828],{"className":17827},[739],[13,17829,17831,17851],{"className":17830},[188,189],[13,17832,17834,17848],{"className":17833},[193],[13,17835,17837],{"className":17836,"style":4153},[197],[13,17838,17839,17842],{"style":4213},[13,17840],{"className":17841,"style":755},[205],[13,17843,17845],{"className":17844},[210,211,212,213],[13,17846,107],{"className":17847,"style":123},[90,91,213],[13,17849,250],{"className":17850},[249],[13,17852,17854],{"className":17853},[193],[13,17855,17857],{"className":17856,"style":8955},[197],[13,17858],{},[13,17860],{"className":17861,"style":8430},[267],[13,17863,3262],{"className":17864,"style":4259},[90,91],[13,17866,8716],{"className":17867},[180],[13,17869,2521],{"className":17870},[90,91],[13,17872,8722],{"className":17873},[263],[13,17875,5739],{"className":17876},[90],[13,17878,107],{"className":17879,"style":123},[90,91],[13,17881],{"className":17882,"style":351},[267],[13,17884,780],{"className":17885},[355],[13,17887],{"className":17888,"style":351},[267],[13,17890,17892,17895],{"className":17891},[90],[13,17893,17],{"className":17894,"style":4259},[90,91],[13,17896,17898],{"className":17897},[739],[13,17899,17901,17921],{"className":17900},[188,189],[13,17902,17904,17918],{"className":17903},[193],[13,17905,17907],{"className":17906,"style":4153},[197],[13,17908,17909,17912],{"style":4274},[13,17910],{"className":17911,"style":755},[205],[13,17913,17915],{"className":17914},[210,211,212,213],[13,17916,107],{"className":17917,"style":123},[90,91,213],[13,17919,250],{"className":17920},[249],[13,17922,17924],{"className":17923},[193],[13,17925,17927],{"className":17926,"style":8955},[197],[13,17928],{},[13,17930,250],{"className":17931},[249],[13,17933,17935],{"className":17934},[193],[13,17936,17938],{"className":17937,"style":10685},[197],[13,17939],{},[10,17941,17942],{},"If we point our forged path fPoints to T directly, the X and Y coordinates of the line will read unrelated heap values, tilting the line. This diagonal tilt leaks coordinates into both axes, destroying our measurement.",[10,17944,17945],{},"Our solution is to align the other coordinates with zero bytes in memory. By sliding our read window W, we force the non-target coordinates to read as zero, which simplifies the math:",[466,17947,17948,18672],{},[413,17949,17950,17953,17954,92,18056,18158,18159,18162],{},[37,17951,17952],{},"Horizontal alignment (s1)",": we force ",[13,17955,17957,17983],{"className":17956},[50],[13,17958,17960],{"className":17959},[54],[56,17961,17962],{"xmlns":58},[60,17963,17964,17980],{},[63,17965,17966,17976,17978],{},[782,17967,17968,17970],{},[66,17969,3262],{},[63,17971,17972,17974],{},[143,17973,1016],{},[66,17975,107],{},[147,17977,566],{},[143,17979,1016],{},[70,17981,17982],{"encoding":72},"P_{0y} = 0",[13,17984,17986,18047],{"className":17985,"ariaHidden":77},[76],[13,17987,17989,17992,18038,18041,18044],{"className":17988},[81],[13,17990],{"className":17991,"style":8910},[85],[13,17993,17995,17998],{"className":17994},[90],[13,17996,3262],{"className":17997,"style":4259},[90,91],[13,17999,18001],{"className":18000},[739],[13,18002,18004,18030],{"className":18003},[188,189],[13,18005,18007,18027],{"className":18006},[193],[13,18008,18010],{"className":18009,"style":828},[197],[13,18011,18012,18015],{"style":4274},[13,18013],{"className":18014,"style":755},[205],[13,18016,18018],{"className":18017},[210,211,212,213],[13,18019,18021,18024],{"className":18020},[90,213],[13,18022,1016],{"className":18023},[90,213],[13,18025,107],{"className":18026,"style":123},[90,91,213],[13,18028,250],{"className":18029},[249],[13,18031,18033],{"className":18032},[193],[13,18034,18036],{"className":18035,"style":8955},[197],[13,18037],{},[13,18039],{"className":18040,"style":268},[267],[13,18042,566],{"className":18043},[272],[13,18045],{"className":18046,"style":268},[267],[13,18048,18050,18053],{"className":18049},[81],[13,18051],{"className":18052,"style":12444},[85],[13,18054,1016],{"className":18055},[90],[13,18057,18059,18085],{"className":18058},[50],[13,18060,18062],{"className":18061},[54],[56,18063,18064],{"xmlns":58},[60,18065,18066,18082],{},[63,18067,18068,18078,18080],{},[782,18069,18070,18072],{},[66,18071,3262],{},[63,18073,18074,18076],{},[143,18075,1085],{},[66,18077,107],{},[147,18079,566],{},[143,18081,1016],{},[70,18083,18084],{"encoding":72},"P_{1y} = 0",[13,18086,18088,18149],{"className":18087,"ariaHidden":77},[76],[13,18089,18091,18094,18140,18143,18146],{"className":18090},[81],[13,18092],{"className":18093,"style":8910},[85],[13,18095,18097,18100],{"className":18096},[90],[13,18098,3262],{"className":18099,"style":4259},[90,91],[13,18101,18103],{"className":18102},[739],[13,18104,18106,18132],{"className":18105},[188,189],[13,18107,18109,18129],{"className":18108},[193],[13,18110,18112],{"className":18111,"style":828},[197],[13,18113,18114,18117],{"style":4274},[13,18115],{"className":18116,"style":755},[205],[13,18118,18120],{"className":18119},[210,211,212,213],[13,18121,18123,18126],{"className":18122},[90,213],[13,18124,1085],{"className":18125},[90,213],[13,18127,107],{"className":18128,"style":123},[90,91,213],[13,18130,250],{"className":18131},[249],[13,18133,18135],{"className":18134},[193],[13,18136,18138],{"className":18137,"style":8955},[197],[13,18139],{},[13,18141],{"className":18142,"style":268},[267],[13,18144,566],{"className":18145},[272],[13,18147],{"className":18148,"style":268},[267],[13,18150,18152,18155],{"className":18151},[81],[13,18153],{"className":18154,"style":12444},[85],[13,18156,1016],{"className":18157},[90],". The line segment collapses to:",[18160,18161],"br",{},[13,18163,18165,18256],{"className":18164},[50],[13,18166,18168],{"className":18167},[54],[56,18169,18170],{"xmlns":58},[60,18171,18172,18253],{},[63,18173,18174,18176,18182,18192,18194,18200,18202,18204,18210,18212,18215,18217,18223,18233,18235,18241,18243,18245,18251],{},[147,18175,539],{"stretchy":1079},[782,18177,18178,18180],{},[66,18179,3217],{},[66,18181,68],{},[782,18183,18184,18186],{},[66,18185,3262],{},[63,18187,18188,18190],{},[143,18189,1016],{},[66,18191,68],{},[147,18193,780],{},[782,18195,18196,18198],{},[66,18197,17],{},[66,18199,68],{},[147,18201,160],{"separator":77},[785,18203,3268],{},[782,18205,18206,18208],{},[66,18207,17],{},[66,18209,107],{},[147,18211,440],{"stretchy":1079},[147,18213,18214],{},"⟶",[147,18216,539],{"stretchy":1079},[782,18218,18219,18221],{},[66,18220,3217],{},[66,18222,68],{},[782,18224,18225,18227],{},[66,18226,3262],{},[63,18228,18229,18231],{},[143,18230,1085],{},[66,18232,68],{},[147,18234,780],{},[782,18236,18237,18239],{},[66,18238,17],{},[66,18240,68],{},[147,18242,160],{"separator":77},[785,18244,3268],{},[782,18246,18247,18249],{},[66,18248,17],{},[66,18250,107],{},[147,18252,440],{"stretchy":1079},[70,18254,18255],{"encoding":72},"(S_x P_{0x} + T_x,\\ T_y) \\longrightarrow (S_x P_{1x} + T_x,\\ T_y)",[13,18257,18259,18363,18470,18574],{"className":18258,"ariaHidden":77},[76],[13,18260,18262,18265,18268,18308,18354,18357,18360],{"className":18261},[81],[13,18263],{"className":18264,"style":6163},[85],[13,18266,539],{"className":18267},[180],[13,18269,18271,18274],{"className":18270},[90],[13,18272,3217],{"className":18273,"style":4198},[90,91],[13,18275,18277],{"className":18276},[739],[13,18278,18280,18300],{"className":18279},[188,189],[13,18281,18283,18297],{"className":18282},[193],[13,18284,18286],{"className":18285,"style":4153},[197],[13,18287,18288,18291],{"style":4213},[13,18289],{"className":18290,"style":755},[205],[13,18292,18294],{"className":18293},[210,211,212,213],[13,18295,68],{"className":18296},[90,91,213],[13,18298,250],{"className":18299},[249],[13,18301,18303],{"className":18302},[193],[13,18304,18306],{"className":18305,"style":853},[197],[13,18307],{},[13,18309,18311,18314],{"className":18310},[90],[13,18312,3262],{"className":18313,"style":4259},[90,91],[13,18315,18317],{"className":18316},[739],[13,18318,18320,18346],{"className":18319},[188,189],[13,18321,18323,18343],{"className":18322},[193],[13,18324,18326],{"className":18325,"style":828},[197],[13,18327,18328,18331],{"style":4274},[13,18329],{"className":18330,"style":755},[205],[13,18332,18334],{"className":18333},[210,211,212,213],[13,18335,18337,18340],{"className":18336},[90,213],[13,18338,1016],{"className":18339},[90,213],[13,18341,68],{"className":18342},[90,91,213],[13,18344,250],{"className":18345},[249],[13,18347,18349],{"className":18348},[193],[13,18350,18352],{"className":18351,"style":853},[197],[13,18353],{},[13,18355],{"className":18356,"style":351},[267],[13,18358,780],{"className":18359},[355],[13,18361],{"className":18362,"style":351},[267],[13,18364,18366,18369,18409,18412,18415,18418,18458,18461,18464,18467],{"className":18365},[81],[13,18367],{"className":18368,"style":17048},[85],[13,18370,18372,18375],{"className":18371},[90],[13,18373,17],{"className":18374,"style":4259},[90,91],[13,18376,18378],{"className":18377},[739],[13,18379,18381,18401],{"className":18380},[188,189],[13,18382,18384,18398],{"className":18383},[193],[13,18385,18387],{"className":18386,"style":4153},[197],[13,18388,18389,18392],{"style":4274},[13,18390],{"className":18391,"style":755},[205],[13,18393,18395],{"className":18394},[210,211,212,213],[13,18396,68],{"className":18397},[90,91,213],[13,18399,250],{"className":18400},[249],[13,18402,18404],{"className":18403},[193],[13,18405,18407],{"className":18406,"style":853},[197],[13,18408],{},[13,18410,160],{"className":18411},[311],[13,18413,3268],{"className":18414},[267],[13,18416],{"className":18417,"style":8430},[267],[13,18419,18421,18424],{"className":18420},[90],[13,18422,17],{"className":18423,"style":4259},[90,91],[13,18425,18427],{"className":18426},[739],[13,18428,18430,18450],{"className":18429},[188,189],[13,18431,18433,18447],{"className":18432},[193],[13,18434,18436],{"className":18435,"style":4153},[197],[13,18437,18438,18441],{"style":4274},[13,18439],{"className":18440,"style":755},[205],[13,18442,18444],{"className":18443},[210,211,212,213],[13,18445,107],{"className":18446,"style":123},[90,91,213],[13,18448,250],{"className":18449},[249],[13,18451,18453],{"className":18452},[193],[13,18454,18456],{"className":18455,"style":8955},[197],[13,18457],{},[13,18459,440],{"className":18460},[263],[13,18462],{"className":18463,"style":268},[267],[13,18465,18214],{"className":18466},[272],[13,18468],{"className":18469,"style":268},[267],[13,18471,18473,18476,18479,18519,18565,18568,18571],{"className":18472},[81],[13,18474],{"className":18475,"style":6163},[85],[13,18477,539],{"className":18478},[180],[13,18480,18482,18485],{"className":18481},[90],[13,18483,3217],{"className":18484,"style":4198},[90,91],[13,18486,18488],{"className":18487},[739],[13,18489,18491,18511],{"className":18490},[188,189],[13,18492,18494,18508],{"className":18493},[193],[13,18495,18497],{"className":18496,"style":4153},[197],[13,18498,18499,18502],{"style":4213},[13,18500],{"className":18501,"style":755},[205],[13,18503,18505],{"className":18504},[210,211,212,213],[13,18506,68],{"className":18507},[90,91,213],[13,18509,250],{"className":18510},[249],[13,18512,18514],{"className":18513},[193],[13,18515,18517],{"className":18516,"style":853},[197],[13,18518],{},[13,18520,18522,18525],{"className":18521},[90],[13,18523,3262],{"className":18524,"style":4259},[90,91],[13,18526,18528],{"className":18527},[739],[13,18529,18531,18557],{"className":18530},[188,189],[13,18532,18534,18554],{"className":18533},[193],[13,18535,18537],{"className":18536,"style":828},[197],[13,18538,18539,18542],{"style":4274},[13,18540],{"className":18541,"style":755},[205],[13,18543,18545],{"className":18544},[210,211,212,213],[13,18546,18548,18551],{"className":18547},[90,213],[13,18549,1085],{"className":18550},[90,213],[13,18552,68],{"className":18553},[90,91,213],[13,18555,250],{"className":18556},[249],[13,18558,18560],{"className":18559},[193],[13,18561,18563],{"className":18562,"style":853},[197],[13,18564],{},[13,18566],{"className":18567,"style":351},[267],[13,18569,780],{"className":18570},[355],[13,18572],{"className":18573,"style":351},[267],[13,18575,18577,18580,18620,18623,18626,18629,18669],{"className":18576},[81],[13,18578],{"className":18579,"style":17048},[85],[13,18581,18583,18586],{"className":18582},[90],[13,18584,17],{"className":18585,"style":4259},[90,91],[13,18587,18589],{"className":18588},[739],[13,18590,18592,18612],{"className":18591},[188,189],[13,18593,18595,18609],{"className":18594},[193],[13,18596,18598],{"className":18597,"style":4153},[197],[13,18599,18600,18603],{"style":4274},[13,18601],{"className":18602,"style":755},[205],[13,18604,18606],{"className":18605},[210,211,212,213],[13,18607,68],{"className":18608},[90,91,213],[13,18610,250],{"className":18611},[249],[13,18613,18615],{"className":18614},[193],[13,18616,18618],{"className":18617,"style":853},[197],[13,18619],{},[13,18621,160],{"className":18622},[311],[13,18624,3268],{"className":18625},[267],[13,18627],{"className":18628,"style":8430},[267],[13,18630,18632,18635],{"className":18631},[90],[13,18633,17],{"className":18634,"style":4259},[90,91],[13,18636,18638],{"className":18637},[739],[13,18639,18641,18661],{"className":18640},[188,189],[13,18642,18644,18658],{"className":18643},[193],[13,18645,18647],{"className":18646,"style":4153},[197],[13,18648,18649,18652],{"style":4274},[13,18650],{"className":18651,"style":755},[205],[13,18653,18655],{"className":18654},[210,211,212,213],[13,18656,107],{"className":18657,"style":123},[90,91,213],[13,18659,250],{"className":18660},[249],[13,18662,18664],{"className":18663},[193],[13,18665,18667],{"className":18666,"style":8955},[197],[13,18668],{},[13,18670,440],{"className":18671},[263],[413,18673,18674,17953,18677,92,18779,18158,18881,18883],{},[37,18675,18676],{},"Vertical alignment (s4)",[13,18678,18680,18706],{"className":18679},[50],[13,18681,18683],{"className":18682},[54],[56,18684,18685],{"xmlns":58},[60,18686,18687,18703],{},[63,18688,18689,18699,18701],{},[782,18690,18691,18693],{},[66,18692,3262],{},[63,18694,18695,18697],{},[143,18696,1016],{},[66,18698,68],{},[147,18700,566],{},[143,18702,1016],{},[70,18704,18705],{"encoding":72},"P_{0x} = 0",[13,18707,18709,18770],{"className":18708,"ariaHidden":77},[76],[13,18710,18712,18715,18761,18764,18767],{"className":18711},[81],[13,18713],{"className":18714,"style":938},[85],[13,18716,18718,18721],{"className":18717},[90],[13,18719,3262],{"className":18720,"style":4259},[90,91],[13,18722,18724],{"className":18723},[739],[13,18725,18727,18753],{"className":18726},[188,189],[13,18728,18730,18750],{"className":18729},[193],[13,18731,18733],{"className":18732,"style":828},[197],[13,18734,18735,18738],{"style":4274},[13,18736],{"className":18737,"style":755},[205],[13,18739,18741],{"className":18740},[210,211,212,213],[13,18742,18744,18747],{"className":18743},[90,213],[13,18745,1016],{"className":18746},[90,213],[13,18748,68],{"className":18749},[90,91,213],[13,18751,250],{"className":18752},[249],[13,18754,18756],{"className":18755},[193],[13,18757,18759],{"className":18758,"style":853},[197],[13,18760],{},[13,18762],{"className":18763,"style":268},[267],[13,18765,566],{"className":18766},[272],[13,18768],{"className":18769,"style":268},[267],[13,18771,18773,18776],{"className":18772},[81],[13,18774],{"className":18775,"style":12444},[85],[13,18777,1016],{"className":18778},[90],[13,18780,18782,18808],{"className":18781},[50],[13,18783,18785],{"className":18784},[54],[56,18786,18787],{"xmlns":58},[60,18788,18789,18805],{},[63,18790,18791,18801,18803],{},[782,18792,18793,18795],{},[66,18794,3262],{},[63,18796,18797,18799],{},[143,18798,1085],{},[66,18800,68],{},[147,18802,566],{},[143,18804,1016],{},[70,18806,18807],{"encoding":72},"P_{1x} = 0",[13,18809,18811,18872],{"className":18810,"ariaHidden":77},[76],[13,18812,18814,18817,18863,18866,18869],{"className":18813},[81],[13,18815],{"className":18816,"style":938},[85],[13,18818,18820,18823],{"className":18819},[90],[13,18821,3262],{"className":18822,"style":4259},[90,91],[13,18824,18826],{"className":18825},[739],[13,18827,18829,18855],{"className":18828},[188,189],[13,18830,18832,18852],{"className":18831},[193],[13,18833,18835],{"className":18834,"style":828},[197],[13,18836,18837,18840],{"style":4274},[13,18838],{"className":18839,"style":755},[205],[13,18841,18843],{"className":18842},[210,211,212,213],[13,18844,18846,18849],{"className":18845},[90,213],[13,18847,1085],{"className":18848},[90,213],[13,18850,68],{"className":18851},[90,91,213],[13,18853,250],{"className":18854},[249],[13,18856,18858],{"className":18857},[193],[13,18859,18861],{"className":18860,"style":853},[197],[13,18862],{},[13,18864],{"className":18865,"style":268},[267],[13,18867,566],{"className":18868},[272],[13,18870],{"className":18871,"style":268},[267],[13,18873,18875,18878],{"className":18874},[81],[13,18876],{"className":18877,"style":12444},[85],[13,18879,1016],{"className":18880},[90],[18160,18882],{},[13,18884,18886,18976],{"className":18885},[50],[13,18887,18889],{"className":18888},[54],[56,18890,18891],{"xmlns":58},[60,18892,18893,18973],{},[63,18894,18895,18897,18903,18905,18907,18913,18923,18925,18931,18933,18935,18937,18943,18945,18947,18953,18963,18965,18971],{},[147,18896,539],{"stretchy":1079},[782,18898,18899,18901],{},[66,18900,17],{},[66,18902,68],{},[147,18904,160],{"separator":77},[785,18906,3268],{},[782,18908,18909,18911],{},[66,18910,3217],{},[66,18912,107],{},[782,18914,18915,18917],{},[66,18916,3262],{},[63,18918,18919,18921],{},[143,18920,1016],{},[66,18922,107],{},[147,18924,780],{},[782,18926,18927,18929],{},[66,18928,17],{},[66,18930,107],{},[147,18932,440],{"stretchy":1079},[147,18934,18214],{},[147,18936,539],{"stretchy":1079},[782,18938,18939,18941],{},[66,18940,17],{},[66,18942,68],{},[147,18944,160],{"separator":77},[785,18946,3268],{},[782,18948,18949,18951],{},[66,18950,3217],{},[66,18952,107],{},[782,18954,18955,18957],{},[66,18956,3262],{},[63,18958,18959,18961],{},[143,18960,1085],{},[66,18962,107],{},[147,18964,780],{},[782,18966,18967,18969],{},[66,18968,17],{},[66,18970,107],{},[147,18972,440],{"stretchy":1079},[70,18974,18975],{"encoding":72},"(T_x,\\ S_y P_{0y} + T_y) \\longrightarrow (T_x,\\ S_y P_{1y} + T_y)",[13,18977,18979,19132,19190,19343],{"className":18978,"ariaHidden":77},[76],[13,18980,18982,18985,18988,19028,19031,19034,19037,19077,19123,19126,19129],{"className":18981},[81],[13,18983],{"className":18984,"style":17048},[85],[13,18986,539],{"className":18987},[180],[13,18989,18991,18994],{"className":18990},[90],[13,18992,17],{"className":18993,"style":4259},[90,91],[13,18995,18997],{"className":18996},[739],[13,18998,19000,19020],{"className":18999},[188,189],[13,19001,19003,19017],{"className":19002},[193],[13,19004,19006],{"className":19005,"style":4153},[197],[13,19007,19008,19011],{"style":4274},[13,19009],{"className":19010,"style":755},[205],[13,19012,19014],{"className":19013},[210,211,212,213],[13,19015,68],{"className":19016},[90,91,213],[13,19018,250],{"className":19019},[249],[13,19021,19023],{"className":19022},[193],[13,19024,19026],{"className":19025,"style":853},[197],[13,19027],{},[13,19029,160],{"className":19030},[311],[13,19032,3268],{"className":19033},[267],[13,19035],{"className":19036,"style":8430},[267],[13,19038,19040,19043],{"className":19039},[90],[13,19041,3217],{"className":19042,"style":4198},[90,91],[13,19044,19046],{"className":19045},[739],[13,19047,19049,19069],{"className":19048},[188,189],[13,19050,19052,19066],{"className":19051},[193],[13,19053,19055],{"className":19054,"style":4153},[197],[13,19056,19057,19060],{"style":4213},[13,19058],{"className":19059,"style":755},[205],[13,19061,19063],{"className":19062},[210,211,212,213],[13,19064,107],{"className":19065,"style":123},[90,91,213],[13,19067,250],{"className":19068},[249],[13,19070,19072],{"className":19071},[193],[13,19073,19075],{"className":19074,"style":8955},[197],[13,19076],{},[13,19078,19080,19083],{"className":19079},[90],[13,19081,3262],{"className":19082,"style":4259},[90,91],[13,19084,19086],{"className":19085},[739],[13,19087,19089,19115],{"className":19088},[188,189],[13,19090,19092,19112],{"className":19091},[193],[13,19093,19095],{"className":19094,"style":828},[197],[13,19096,19097,19100],{"style":4274},[13,19098],{"className":19099,"style":755},[205],[13,19101,19103],{"className":19102},[210,211,212,213],[13,19104,19106,19109],{"className":19105},[90,213],[13,19107,1016],{"className":19108},[90,213],[13,19110,107],{"className":19111,"style":123},[90,91,213],[13,19113,250],{"className":19114},[249],[13,19116,19118],{"className":19117},[193],[13,19119,19121],{"className":19120,"style":8955},[197],[13,19122],{},[13,19124],{"className":19125,"style":351},[267],[13,19127,780],{"className":19128},[355],[13,19130],{"className":19131,"style":351},[267],[13,19133,19135,19138,19178,19181,19184,19187],{"className":19134},[81],[13,19136],{"className":19137,"style":17048},[85],[13,19139,19141,19144],{"className":19140},[90],[13,19142,17],{"className":19143,"style":4259},[90,91],[13,19145,19147],{"className":19146},[739],[13,19148,19150,19170],{"className":19149},[188,189],[13,19151,19153,19167],{"className":19152},[193],[13,19154,19156],{"className":19155,"style":4153},[197],[13,19157,19158,19161],{"style":4274},[13,19159],{"className":19160,"style":755},[205],[13,19162,19164],{"className":19163},[210,211,212,213],[13,19165,107],{"className":19166,"style":123},[90,91,213],[13,19168,250],{"className":19169},[249],[13,19171,19173],{"className":19172},[193],[13,19174,19176],{"className":19175,"style":8955},[197],[13,19177],{},[13,19179,440],{"className":19180},[263],[13,19182],{"className":19183,"style":268},[267],[13,19185,18214],{"className":19186},[272],[13,19188],{"className":19189,"style":268},[267],[13,19191,19193,19196,19199,19239,19242,19245,19248,19288,19334,19337,19340],{"className":19192},[81],[13,19194],{"className":19195,"style":17048},[85],[13,19197,539],{"className":19198},[180],[13,19200,19202,19205],{"className":19201},[90],[13,19203,17],{"className":19204,"style":4259},[90,91],[13,19206,19208],{"className":19207},[739],[13,19209,19211,19231],{"className":19210},[188,189],[13,19212,19214,19228],{"className":19213},[193],[13,19215,19217],{"className":19216,"style":4153},[197],[13,19218,19219,19222],{"style":4274},[13,19220],{"className":19221,"style":755},[205],[13,19223,19225],{"className":19224},[210,211,212,213],[13,19226,68],{"className":19227},[90,91,213],[13,19229,250],{"className":19230},[249],[13,19232,19234],{"className":19233},[193],[13,19235,19237],{"className":19236,"style":853},[197],[13,19238],{},[13,19240,160],{"className":19241},[311],[13,19243,3268],{"className":19244},[267],[13,19246],{"className":19247,"style":8430},[267],[13,19249,19251,19254],{"className":19250},[90],[13,19252,3217],{"className":19253,"style":4198},[90,91],[13,19255,19257],{"className":19256},[739],[13,19258,19260,19280],{"className":19259},[188,189],[13,19261,19263,19277],{"className":19262},[193],[13,19264,19266],{"className":19265,"style":4153},[197],[13,19267,19268,19271],{"style":4213},[13,19269],{"className":19270,"style":755},[205],[13,19272,19274],{"className":19273},[210,211,212,213],[13,19275,107],{"className":19276,"style":123},[90,91,213],[13,19278,250],{"className":19279},[249],[13,19281,19283],{"className":19282},[193],[13,19284,19286],{"className":19285,"style":8955},[197],[13,19287],{},[13,19289,19291,19294],{"className":19290},[90],[13,19292,3262],{"className":19293,"style":4259},[90,91],[13,19295,19297],{"className":19296},[739],[13,19298,19300,19326],{"className":19299},[188,189],[13,19301,19303,19323],{"className":19302},[193],[13,19304,19306],{"className":19305,"style":828},[197],[13,19307,19308,19311],{"style":4274},[13,19309],{"className":19310,"style":755},[205],[13,19312,19314],{"className":19313},[210,211,212,213],[13,19315,19317,19320],{"className":19316},[90,213],[13,19318,1085],{"className":19319},[90,213],[13,19321,107],{"className":19322,"style":123},[90,91,213],[13,19324,250],{"className":19325},[249],[13,19327,19329],{"className":19328},[193],[13,19330,19332],{"className":19331,"style":8955},[197],[13,19333],{},[13,19335],{"className":19336,"style":351},[267],[13,19338,780],{"className":19339},[355],[13,19341],{"className":19342,"style":351},[267],[13,19344,19346,19349,19389],{"className":19345},[81],[13,19347],{"className":19348,"style":17048},[85],[13,19350,19352,19355],{"className":19351},[90],[13,19353,17],{"className":19354,"style":4259},[90,91],[13,19356,19358],{"className":19357},[739],[13,19359,19361,19381],{"className":19360},[188,189],[13,19362,19364,19378],{"className":19363},[193],[13,19365,19367],{"className":19366,"style":4153},[197],[13,19368,19369,19372],{"style":4274},[13,19370],{"className":19371,"style":755},[205],[13,19373,19375],{"className":19374},[210,211,212,213],[13,19376,107],{"className":19377,"style":123},[90,91,213],[13,19379,250],{"className":19380},[249],[13,19382,19384],{"className":19383},[193],[13,19385,19387],{"className":19386,"style":8955},[197],[13,19388],{},[13,19390,440],{"className":19391},[263],[10,19393,19394],{},"We call this Zero Framing, and it comes in two flavors depending on the structure layout:",[410,19396,19397,19403],{},[413,19398,19399,19402],{},[37,19400,19401],{},"ZA (Zero Adjacent)",": the neighbor field is a 48-bit pointer. Since user-space pointers on 64-bit Linux have their top 16 bits as zero, the upper bytes of the neighbor are expected to be zero.",[413,19404,19405,19408],{},[37,19406,19407],{},"ZB (Zero Block)",": the neighbor field is padding, a null pointer, or a zeroed integer (the whole qword is zero).",[10,19410,19411],{},"By aligning W so that the companion coordinate's exponent byte lands on zero memory, we drive that coordinate to ~0 and force the line flat (s1) or vertical (s4). The ZA form uses the zero top bytes of an adjacent 48-bit pointer; the ZB form shifts W an extra 8 bytes (the T-9 and T-12 entries below) so an all-zero qword frames the companion SkPoint instead, leaving the recovered-byte positions unchanged.",[13,19413,19415],{"className":19414},[989],[13,19416,19418,19581],{"className":19417},[50],[13,19419,19421],{"className":19420},[54],[56,19422,19423],{"xmlns":58,"display":998},[60,19424,19425,19578],{},[1002,19426,19427,19502],{"rowspacing":1004,"columnalign":1005,"columnspacing":1006},[1008,19428,19429,19450,19466,19486],{},[1011,19430,19431],{},[1014,19432,19433],{"scriptlevel":1016,"displaystyle":77},[63,19434,19435,19441,19443],{},[782,19436,19437,19439],{},[66,19438,1039],{},[143,19440,1085],{},[785,19442,3268],{},[63,19444,19445,19448],{},[66,19446,19447],{"mathvariant":871},"Z",[66,19449,3265],{"mathvariant":871},[1011,19451,19452],{},[1014,19453,19454],{"scriptlevel":1016,"displaystyle":77},[63,19455,19456,19458,19460,19462,19464],{},[63,19457],{},[147,19459,985],{},[66,19461,17],{},[147,19463,329],{},[143,19465,1085],{},[1011,19467,19468],{},[1014,19469,19470],{"scriptlevel":1016,"displaystyle":77},[63,19471,19472,19478,19480],{},[782,19473,19474,19476],{},[66,19475,1039],{},[143,19477,2961],{},[785,19479,3268],{},[63,19481,19482,19484],{},[66,19483,19447],{"mathvariant":871},[66,19485,3265],{"mathvariant":871},[1011,19487,19488],{},[1014,19489,19490],{"scriptlevel":1016,"displaystyle":77},[63,19491,19492,19494,19496,19498,19500],{},[63,19493],{},[147,19495,985],{},[66,19497,17],{},[147,19499,329],{},[143,19501,2961],{},[1008,19503,19504,19525,19542,19562],{},[1011,19505,19506],{},[1014,19507,19508],{"scriptlevel":1016,"displaystyle":77},[63,19509,19510,19516,19518],{},[782,19511,19512,19514],{},[66,19513,1039],{},[143,19515,1085],{},[785,19517,3268],{},[63,19519,19520,19522],{},[66,19521,19447],{"mathvariant":871},[66,19523,19524],{"mathvariant":871},"B",[1011,19526,19527],{},[1014,19528,19529],{"scriptlevel":1016,"displaystyle":77},[63,19530,19531,19533,19535,19537,19539],{},[63,19532],{},[147,19534,985],{},[66,19536,17],{},[147,19538,329],{},[143,19540,19541],{},"9",[1011,19543,19544],{},[1014,19545,19546],{"scriptlevel":1016,"displaystyle":77},[63,19547,19548,19554,19556],{},[782,19549,19550,19552],{},[66,19551,1039],{},[143,19553,2961],{},[785,19555,3268],{},[63,19557,19558,19560],{},[66,19559,19447],{"mathvariant":871},[66,19561,19524],{"mathvariant":871},[1011,19563,19564],{},[1014,19565,19566],{"scriptlevel":1016,"displaystyle":77},[63,19567,19568,19570,19572,19574,19576],{},[63,19569],{},[147,19571,985],{},[66,19573,17],{},[147,19575,329],{},[143,19577,11814],{},[70,19579,19580],{"encoding":72},"\\begin{aligned}\ns_1\\ \\mathrm{ZA} &: T - 1 & s_4\\ \\mathrm{ZA} &: T - 4 \\\\\ns_1\\ \\mathrm{ZB} &: T - 9 & s_4\\ \\mathrm{ZB} &: T - 12\n\\end{aligned}",[13,19582,19584],{"className":19583,"ariaHidden":77},[76],[13,19585,19587,19590],{"className":19586},[81],[13,19588],{"className":19589,"style":10592},[85],[13,19591,19593],{"className":19592},[90],[13,19594,19596,19735,19828,19831,19968],{"className":19595},[1002],[13,19597,19599],{"className":19598},[1363],[13,19600,19602,19727],{"className":19601},[188,189],[13,19603,19605,19724],{"className":19604},[193],[13,19606,19608,19666],{"className":19607,"style":10611},[197],[13,19609,19610,19613],{"style":10614},[13,19611],{"className":19612,"style":206},[205],[13,19614,19616,19656,19659],{"className":19615},[90],[13,19617,19619,19622],{"className":19618},[90],[13,19620,1039],{"className":19621},[90,91],[13,19623,19625],{"className":19624},[739],[13,19626,19628,19648],{"className":19627},[188,189],[13,19629,19631,19645],{"className":19630},[193],[13,19632,19634],{"className":19633,"style":828},[197],[13,19635,19636,19639],{"style":5027},[13,19637],{"className":19638,"style":755},[205],[13,19640,19642],{"className":19641},[210,211,212,213],[13,19643,1085],{"className":19644},[90,213],[13,19646,250],{"className":19647},[249],[13,19649,19651],{"className":19650},[193],[13,19652,19654],{"className":19653,"style":853},[197],[13,19655],{},[13,19657,3268],{"className":19658},[267],[13,19660,19662],{"className":19661},[90],[13,19663,19665],{"className":19664},[90,922],"ZA",[13,19667,19668,19671],{"style":10669},[13,19669],{"className":19670,"style":206},[205],[13,19672,19674,19714,19717],{"className":19673},[90],[13,19675,19677,19680],{"className":19676},[90],[13,19678,1039],{"className":19679},[90,91],[13,19681,19683],{"className":19682},[739],[13,19684,19686,19706],{"className":19685},[188,189],[13,19687,19689,19703],{"className":19688},[193],[13,19690,19692],{"className":19691,"style":828},[197],[13,19693,19694,19697],{"style":5027},[13,19695],{"className":19696,"style":755},[205],[13,19698,19700],{"className":19699},[210,211,212,213],[13,19701,1085],{"className":19702},[90,213],[13,19704,250],{"className":19705},[249],[13,19707,19709],{"className":19708},[193],[13,19710,19712],{"className":19711,"style":853},[197],[13,19713],{},[13,19715,3268],{"className":19716},[267],[13,19718,19720],{"className":19719},[90],[13,19721,19723],{"className":19722},[90,922],"ZB",[13,19725,250],{"className":19726},[249],[13,19728,19730],{"className":19729},[193],[13,19731,19733],{"className":19732,"style":10685},[197],[13,19734],{},[13,19736,19738],{"className":19737},[1456],[13,19739,19741,19820],{"className":19740},[188,189],[13,19742,19744,19817],{"className":19743},[193],[13,19745,19747,19782],{"className":19746,"style":10611},[197],[13,19748,19749,19752],{"style":10614},[13,19750],{"className":19751,"style":206},[205],[13,19753,19755,19758,19761,19764,19767,19770,19773,19776,19779],{"className":19754},[90],[13,19756],{"className":19757},[90],[13,19759],{"className":19760,"style":268},[267],[13,19762,985],{"className":19763},[272],[13,19765],{"className":19766,"style":268},[267],[13,19768,17],{"className":19769,"style":4259},[90,91],[13,19771],{"className":19772,"style":351},[267],[13,19774,329],{"className":19775},[355],[13,19777],{"className":19778,"style":351},[267],[13,19780,1085],{"className":19781},[90],[13,19783,19784,19787],{"style":10669},[13,19785],{"className":19786,"style":206},[205],[13,19788,19790,19793,19796,19799,19802,19805,19808,19811,19814],{"className":19789},[90],[13,19791],{"className":19792},[90],[13,19794],{"className":19795,"style":268},[267],[13,19797,985],{"className":19798},[272],[13,19800],{"className":19801,"style":268},[267],[13,19803,17],{"className":19804,"style":4259},[90,91],[13,19806],{"className":19807,"style":351},[267],[13,19809,329],{"className":19810},[355],[13,19812],{"className":19813,"style":351},[267],[13,19815,19541],{"className":19816},[90],[13,19818,250],{"className":19819},[249],[13,19821,19823],{"className":19822},[193],[13,19824,19826],{"className":19825,"style":10685},[197],[13,19827],{},[13,19829],{"className":19830,"style":2001},[2000],[13,19832,19834],{"className":19833},[1363],[13,19835,19837,19960],{"className":19836},[188,189],[13,19838,19840,19957],{"className":19839},[193],[13,19841,19843,19900],{"className":19842,"style":10611},[197],[13,19844,19845,19848],{"style":10614},[13,19846],{"className":19847,"style":206},[205],[13,19849,19851,19891,19894],{"className":19850},[90],[13,19852,19854,19857],{"className":19853},[90],[13,19855,1039],{"className":19856},[90,91],[13,19858,19860],{"className":19859},[739],[13,19861,19863,19883],{"className":19862},[188,189],[13,19864,19866,19880],{"className":19865},[193],[13,19867,19869],{"className":19868,"style":828},[197],[13,19870,19871,19874],{"style":5027},[13,19872],{"className":19873,"style":755},[205],[13,19875,19877],{"className":19876},[210,211,212,213],[13,19878,2961],{"className":19879},[90,213],[13,19881,250],{"className":19882},[249],[13,19884,19886],{"className":19885},[193],[13,19887,19889],{"className":19888,"style":853},[197],[13,19890],{},[13,19892,3268],{"className":19893},[267],[13,19895,19897],{"className":19896},[90],[13,19898,19665],{"className":19899},[90,922],[13,19901,19902,19905],{"style":10669},[13,19903],{"className":19904,"style":206},[205],[13,19906,19908,19948,19951],{"className":19907},[90],[13,19909,19911,19914],{"className":19910},[90],[13,19912,1039],{"className":19913},[90,91],[13,19915,19917],{"className":19916},[739],[13,19918,19920,19940],{"className":19919},[188,189],[13,19921,19923,19937],{"className":19922},[193],[13,19924,19926],{"className":19925,"style":828},[197],[13,19927,19928,19931],{"style":5027},[13,19929],{"className":19930,"style":755},[205],[13,19932,19934],{"className":19933},[210,211,212,213],[13,19935,2961],{"className":19936},[90,213],[13,19938,250],{"className":19939},[249],[13,19941,19943],{"className":19942},[193],[13,19944,19946],{"className":19945,"style":853},[197],[13,19947],{},[13,19949,3268],{"className":19950},[267],[13,19952,19954],{"className":19953},[90],[13,19955,19723],{"className":19956},[90,922],[13,19958,250],{"className":19959},[249],[13,19961,19963],{"className":19962},[193],[13,19964,19966],{"className":19965,"style":10685},[197],[13,19967],{},[13,19969,19971],{"className":19970},[1456],[13,19972,19974,20053],{"className":19973},[188,189],[13,19975,19977,20050],{"className":19976},[193],[13,19978,19980,20015],{"className":19979,"style":10611},[197],[13,19981,19982,19985],{"style":10614},[13,19983],{"className":19984,"style":206},[205],[13,19986,19988,19991,19994,19997,20000,20003,20006,20009,20012],{"className":19987},[90],[13,19989],{"className":19990},[90],[13,19992],{"className":19993,"style":268},[267],[13,19995,985],{"className":19996},[272],[13,19998],{"className":19999,"style":268},[267],[13,20001,17],{"className":20002,"style":4259},[90,91],[13,20004],{"className":20005,"style":351},[267],[13,20007,329],{"className":20008},[355],[13,20010],{"className":20011,"style":351},[267],[13,20013,2961],{"className":20014},[90],[13,20016,20017,20020],{"style":10669},[13,20018],{"className":20019,"style":206},[205],[13,20021,20023,20026,20029,20032,20035,20038,20041,20044,20047],{"className":20022},[90],[13,20024],{"className":20025},[90],[13,20027],{"className":20028,"style":268},[267],[13,20030,985],{"className":20031},[272],[13,20033],{"className":20034,"style":268},[267],[13,20036,17],{"className":20037,"style":4259},[90,91],[13,20039],{"className":20040,"style":351},[267],[13,20042,329],{"className":20043},[355],[13,20045],{"className":20046,"style":351},[267],[13,20048,11814],{"className":20049},[90],[13,20051,250],{"className":20052},[249],[13,20054,20056],{"className":20055},[193],[13,20057,20059],{"className":20058,"style":10685},[197],[13,20060],{},[10,20062,20063],{},"A single forge recovers only part of the pointer. The s1 forge reads three bytes at once (b0-b2 encoded as one target float, whose sign\u002Fexponent byte b2 pins the magnitude for the zoom search); the s4 forge reads a single byte (b3). We therefore use two separate shifted forges to reconstruct the low 32 bits:",[8593,20065],{":columns":20066,":rows":20067,"title":20068},"[\"T-1\",\"T\",\"T+1\",\"T+2\",\"T+3\",\"T+4\",\"T+5\",\"T+6\"]","[{\"fields\":[{\"label\":\"frame\",\"start\":0,\"span\":1},{\"label\":\"b0\",\"start\":1,\"span\":1},{\"label\":\"b1\",\"start\":2,\"span\":1},{\"label\":\"b2\",\"start\":3,\"span\":1},{\"label\":\"b3\",\"start\":4,\"span\":1},{\"label\":\"b4\",\"start\":5,\"span\":1},{\"label\":\"b5\",\"start\":6,\"span\":1},{\"label\":\"b6=0\",\"start\":7,\"span\":1}]},{\"fields\":[{\"label\":\"P0.x: recovers b0..b2\",\"sub\":\"(target float)\",\"start\":0,\"span\":4},{\"label\":\"P0.y: exponent b6=0\",\"sub\":\"(flat, reads ~0)\",\"start\":4,\"span\":4}]}]","s1 forge (W = T - 1)",[8593,20070],{":columns":20071,":rows":20072,"title":20073},"[\"T-4\",\"T-3\",\"T-2\",\"T-1\",\"T\",\"T+1\",\"T+2\",\"T+3\"]","[{\"fields\":[{\"label\":\"q4\",\"start\":0,\"span\":1},{\"label\":\"q5\",\"start\":1,\"span\":1},{\"label\":\"q6\",\"start\":2,\"span\":1},{\"label\":\"q7=0\",\"start\":3,\"span\":1},{\"label\":\"b0\",\"start\":4,\"span\":1},{\"label\":\"b1\",\"start\":5,\"span\":1},{\"label\":\"b2\",\"start\":6,\"span\":1},{\"label\":\"b3\",\"start\":7,\"span\":1}]},{\"fields\":[{\"label\":\"P0.x: exponent q7=0\",\"sub\":\"(vert, reads ~0)\",\"start\":0,\"span\":4},{\"label\":\"P0.y: recovers b3\",\"sub\":\"(target float)\",\"start\":4,\"span\":4}]}]","s4 forge (W = T - 4)",[10,20075,20076,20077,20079],{},"Combining s1 and s4 recovers the low four bytes (b0-b3) of ",[437,20078,16930],{},"; the top two bytes (b4, b5) come from the already-known pool tag, completing the full 48-bit pointer.",[487,20081,20082],{"type":489},[10,20083,20084],{},"Sliding the read window so companion coordinates land on zero bytes collapses the 2D line into a 1D axis-aligned segment, letting us reuse the zoom search for arbitrary pointer reads.",[10,20086,20087],{},"With this arbitrary read primitive, we can now traverse the GPU's internal object graph.",[449,20089,20091],{"id":20090},"the-graph-walk","The graph walk",[10,20093,20094],{},"To walk from RasterDecoderImpl to GrGLInterface, every traversed pointer must satisfy the ZA\u002FZB framing to be readable:",[20096,20097,20098,20114],"table",{},[20099,20100,20101],"thead",{},[20102,20103,20104,20108,20111],"tr",{},[20105,20106,20107],"th",{},"from",[20105,20109,20110],{},"field",[20105,20112,20113],{},"to",[20115,20116,20117,20129,20139,20149,20159,20169,20179,20189],"tbody",{},[20102,20118,20119,20123,20126],{},[20120,20121,20122],"td",{},"RasterDecoderImpl",[20120,20124,20125],{},"query_manager_",[20120,20127,20128],{},"RasterQueryManager",[20102,20130,20131,20133,20136],{},[20120,20132,20128],{},[20120,20134,20135],{},"shared_context_state_",[20120,20137,20138],{},"SharedContextState",[20102,20140,20141,20143,20146],{},[20120,20142,20138],{},[20120,20144,20145],{},"gr_context_",[20120,20147,20148],{},"GrDirectContext",[20102,20150,20151,20153,20156],{},[20120,20152,20148],{},[20120,20154,20155],{},"fResourceProvider",[20120,20157,20158],{},"GrResourceProvider",[20102,20160,20161,20163,20166],{},[20120,20162,20158],{},[20120,20164,20165],{},"fNonAAQuadIndexBuffer",[20120,20167,20168],{},"GrGpuBuffer",[20102,20170,20171,20173,20176],{},[20120,20172,20168],{},[20120,20174,20175],{},"fGpu",[20120,20177,20178],{},"GrGLGpu",[20102,20180,20181,20183,20186],{},[20120,20182,20178],{},[20120,20184,20185],{},"fGLContext",[20120,20187,20188],{},"GrGLContext",[20102,20190,20191,20193,20196],{},[20120,20192,20188],{},[20120,20194,20195],{},"fInterface",[20120,20197,16726],{},[10,20199,20200],{},"This 8-hop walk requires 16 forges and about 75 bisection probes, taking about 1 minute to dynamically resolve GrGLInterface.",[42,20202,20203],{},[10,20204,20205],{},"How did I find this path? Writing the search script is an exercise left to readers.",[10,20207,20208],{},"We can shorten the path by leveraging direct owner pointers: GrDirectContext owns GrGLGpu directly through fGpu, bypassing fResourceProvider and the buffer hops:",[508,20210,20213],{"className":20211,"code":20212,"language":687,"meta":513},[685],"full  (8 hops):  grctx -> resprov -> quadbuf -> glgpu\nshort (6 hops):  grctx -> glgpu\n",[437,20214,20212],{"__ignoreMap":513},[10,20216,20217],{},"Other shorter walks exist in the object graph, but they do not satisfy the ZA\u002FZB framing.",[29,20219,20221],{"id":20220},"putting-it-together","Putting it together",[10,20223,20224],{},"Conceptually, the exploit resolves in three main stages:",[466,20226,20227,20233,20239],{},[413,20228,20229,20232],{},[37,20230,20231],{},"Heap shaping & forge",": spraying transfer-cache entries grooms the heap. Triggering the PathStencilCoverOp overflow corrupts the victim's pointers, establishing a reliable \"forge\" write primitive.",[413,20234,20235,20238],{},[37,20236,20237],{},"Information leak (visual oracle)",": we turn Skia's rasterization loop into a high-fidelity visual oracle to read back memory bytes, bypassing ASLR by leaking the RasterDecoderImpl address and resolving the pool tag.",[413,20240,20241,20244],{},[37,20242,20243],{},"Execution dispatch",": we trigger a UAF on GrGLInterface, reclaim the freed slot with our fake function table, and intercept the next GL call to redirect control flow to mkdir.",[10,20246,20247],{},"While the run is highly deterministic, background allocator churn can occasionally cause failure due to:",[410,20249,20250,20253,20256],{},[413,20251,20252],{},"Stolen holes or wedged objects in the groom stage.",[413,20254,20255],{},"Lost reclaim races where another thread grabs the freed interface first.",[413,20257,20258],{},"Float degeneracies where specific pointer bytes fail IEEE-754 limits.",[10,20260,20261],{},"Because a process crash simply spawns a fresh GPU process with a clean heap, the exploit simply retries until it succeeds.",[29,20263,20265],{"id":20264},"glossary","Glossary",[410,20267,20268,20274,20280,20286,20292,20297,20303,20309,20314,20320,20326,20332],{},[413,20269,20270,20273],{},[37,20271,20272],{},"PartitionAlloc (PA)",": Chromium's heap allocator, segregating allocations by size class (\"buckets\").",[413,20275,20276,20279],{},[37,20277,20278],{},"Pool tag",": the top 16 bits (here 0x1adc) carried by BRP-pool pointers. Only bits 34-47 are strictly pool-invariant; the walked init-time objects also share bits 32-33, so all 16 are reused to rebuild leaked pointers.",[413,20281,20282,20285],{},[37,20283,20284],{},"SkPath \u002F SkPathData",": Skia's path structures, used here as the OOB write victim and overflow trigger.",[413,20287,20288,20291],{},[37,20289,20290],{},"PathStencilCoverOp",": the Skia rendering operation containing the integer overflow vulnerability.",[413,20293,20294,20296],{},[37,20295,16726],{},": Skia's interface of OpenGL function pointers; the target of our arbitrary call hijacking.",[413,20298,20299,20302],{},[37,20300,20301],{},"GrGLFunction",": Skia's function wrapper containing the invoker (fCall) and closure buffer (fBuf).",[413,20304,20305,20308],{},[437,20306,20307],{},"sk_sp\u003CT>",": Skia's intrusive ref-counted smart pointer, which does not acquire BackupRefPtr metadata.",[413,20310,20311,20313],{},[437,20312,439],{},": Chromium's BackupRefPtr-protected pointer wrapper designed to prevent UAF.",[413,20315,20316,20319],{},[37,20317,20318],{},"forge",": the controlled-write primitive built on the cascade heap overflow.",[413,20321,20322,20325],{},[37,20323,20324],{},"c1read",": the controlled-read primitive consisting of two forges and pixel readback.",[413,20327,20328,20331],{},[37,20329,20330],{},"ZA \u002F ZB framing",": alignment conditions on the adjacent qword that satisfy float-to-int conversion constraints.",[413,20333,20334,20337],{},[37,20335,20336],{},"walk",": chained c1read pointer reads traversing the GPU object graph.",[29,20339,20341],{"id":20340},"references","References",[466,20343,20344,20354,20361,20368,20375,20383,20386,20395],{},[413,20345,20346,20347,20353],{},"Chromium Authors, ",[1036,20348,20352],{"href":20349,"rel":20350},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Fbase\u002Fallocator\u002Fpartition_allocator\u002FPartitionAlloc.md",[20351],"nofollow","\"PartitionAlloc Design\"",", 2024.",[413,20355,20346,20356,20353],{},[1036,20357,20360],{"href":20358,"rel":20359},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Fbase\u002Fmemory\u002Fraw_ptr.md",[20351],"\"BackupRefPtr (MiraclePtr)\"",[413,20362,20346,20363,20353],{},[1036,20364,20367],{"href":20365,"rel":20366},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Fdocs\u002Fcontrol_flow_integrity.md",[20351],"\"Control Flow Integrity (CFI)\"",[413,20369,20346,20370,5739],{},[1036,20371,20374],{"href":20372,"rel":20373},"https:\u002F\u002Fchromium.googlesource.com\u002Fchromium\u002Fsrc\u002F+\u002Fmaster\u002Ftools\u002Fcfi\u002Fignores.txt",[20351],"\"CFI ignore list (tools\u002Fcfi\u002Fignores.txt)\"",[413,20376,20377,20378,5739],{},"Skia Authors, ",[1036,20379,20382],{"href":20380,"rel":20381},"https:\u002F\u002Fskia.org\u002F",[20351],"\"Skia Graphics Library\"",[413,20384,20385],{},"P. H. Sterbenz, \"Floating-Point Computation\", Prentice-Hall, 1974.",[413,20387,20388,20389,20394],{},"IEEE, ",[1036,20390,20393],{"href":20391,"rel":20392},"https:\u002F\u002Fstandards.ieee.org\u002Fieee\u002F754\u002F6210\u002F",[20351],"\"IEEE Standard for Floating-Point Arithmetic\"",", IEEE 754-2019.",[413,20396,20397,20398,20403],{},"Chromium Bug Tracker, ",[1036,20399,20402],{"href":20400,"rel":20401},"https:\u002F\u002Fcrbug.com\u002F242999",[20351],"crbug.com\u002F242999"," (referenced in Logger::Logger hex-encode path).",[29,20405,20407],{"id":20406},"shouts","Shouts",[410,20409,20410,20413,20416,20419,20422,20425,20428,20431,20434,20437],{},[413,20411,20412],{},"the chrome-security team, for paying out the bounties that funded our local caffeine supply.",[413,20414,20415],{},"the skia and v8 engineers, for providing such a beautifully complex, yet groomable canvas so we can express our art.",[413,20417,20418],{},"PartitionAlloc's LIFO freelist, for popping our reclaimed slot first.",[413,20420,20421],{},"all fellow heap-sprayers, pointer-chasers, and float-bisectors.",[413,20423,20424],{},"Pat H. Sterbenz, the real OG whose lemma keeps our oracle honest.",[413,20426,20427],{},"zero bytes everywhere, for staying null when we needed you most.",[413,20429,20430],{},"our GPU, for not melting during the 1.43B verb cascade prepare loop.",[413,20432,20433],{},"the phrack staff and community, past, present, and root.",[413,20435,20436],{},"Calif.IO, for paying our researcher's salary.",[413,20438,20439],{},"Anthropic's Claude, who hallucinated at least three wrong exploits before casually generating real creative math ideas like a boss.",[29,20441,20443],{"id":20442},"exploit-source","Exploit source",[10,20445,20446],{},"The complete runnable PoC, targeting Google Chrome Stable 146.0.7680.164 on Linux x64:",[10,20448,20449,20453],{},[1036,20450,20452],{"href":20451},"\u002Fdownloads\u002Freading-memory-poc.tar.xz","Download reading-memory-poc.tar.xz"," (76.5 KB)",[508,20455,20459],{"className":20456,"code":20457,"language":20458,"meta":513,"style":513},"language-bash shiki shiki-themes github-light github-dark","tar xJf reading-memory-poc.tar.xz\nCHROME=\u002Fpath\u002Fto\u002Fchrome-146 .\u002Fmojojs_exploit\u002Frun_mojojs.sh\n","bash",[437,20460,20461,20472],{"__ignoreMap":513},[13,20462,20463,20466,20469],{"class":518,"line":519},[13,20464,20465],{"class":529},"tar",[13,20467,20468],{"class":594}," xJf",[13,20470,20471],{"class":594}," reading-memory-poc.tar.xz\n",[13,20473,20474,20477,20479,20482],{"class":518,"line":526},[13,20475,20476],{"class":533},"CHROME",[13,20478,566],{"class":542},[13,20480,20481],{"class":594},"\u002Fpath\u002Fto\u002Fchrome-146",[13,20483,20484],{"class":529}," .\u002Fmojojs_exploit\u002Frun_mojojs.sh\n",[20486,20487,20488],"style",{},"html pre.shiki code .sJ8bj, html code.shiki .sJ8bj{--shiki-default:#6A737D;--shiki-dark:#6A737D}html pre.shiki code .sScJk, html code.shiki .sScJk{--shiki-default:#6F42C1;--shiki-dark:#B392F0}html pre.shiki code .sVt8B, html code.shiki .sVt8B{--shiki-default:#24292E;--shiki-dark:#E1E4E8}html pre.shiki code .szBVR, html code.shiki .szBVR{--shiki-default:#D73A49;--shiki-dark:#F97583}html pre.shiki code .sj4cs, html code.shiki .sj4cs{--shiki-default:#005CC5;--shiki-dark:#79B8FF}html pre.shiki code .sZZnC, html code.shiki .sZZnC{--shiki-default:#032F62;--shiki-dark:#9ECBFF}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html pre.shiki code .s4XuR, html code.shiki .s4XuR{--shiki-default:#E36209;--shiki-dark:#FFAB70}",{"title":513,"searchDepth":555,"depth":555,"links":20490},[20491,20492,20493,20494,20497,20501,20505,20510,20515,20519,20523,20530,20534,20535,20536,20537,20538],{"id":31,"depth":526,"text":32},{"id":377,"depth":526,"text":378},{"id":388,"depth":526,"text":389},{"id":404,"depth":526,"text":405,"children":20495},[20496],{"id":451,"depth":555,"text":452},{"id":498,"depth":526,"text":499,"children":20498},[20499,20500],{"id":505,"depth":555,"text":506},{"id":692,"depth":555,"text":693},{"id":2138,"depth":526,"text":2139,"children":20502},[20503,20504],{"id":2145,"depth":555,"text":2146},{"id":2160,"depth":555,"text":2161},{"id":2211,"depth":526,"text":2212,"children":20506},[20507,20508,20509],{"id":2215,"depth":555,"text":2216},{"id":2483,"depth":555,"text":2484},{"id":3710,"depth":555,"text":3711},{"id":3734,"depth":526,"text":3735,"children":20511},[20512,20513,20514],{"id":3764,"depth":555,"text":3765},{"id":3780,"depth":555,"text":3781},{"id":3911,"depth":555,"text":3912},{"id":3930,"depth":526,"text":3931,"children":20516},[20517,20518],{"id":3960,"depth":555,"text":3961},{"id":4024,"depth":555,"text":4025},{"id":4060,"depth":526,"text":4061,"children":20520},[20521,20522],{"id":4445,"depth":555,"text":4446},{"id":8578,"depth":555,"text":8579},{"id":16548,"depth":526,"text":16549,"children":20524},[20525,20526,20527,20528,20529],{"id":16555,"depth":555,"text":16556},{"id":16591,"depth":555,"text":16592},{"id":16619,"depth":555,"text":16620},{"id":16821,"depth":555,"text":16822},{"id":16840,"depth":555,"text":16841},{"id":16908,"depth":526,"text":16909,"children":20531},[20532,20533],{"id":16923,"depth":555,"text":16924},{"id":20090,"depth":555,"text":20091},{"id":20220,"depth":526,"text":20221},{"id":20264,"depth":526,"text":20265},{"id":20340,"depth":526,"text":20341},{"id":20406,"depth":526,"text":20407},{"id":20442,"depth":526,"text":20443},"2026-08-06","A short note on the ideas behind a Chromium renderer-to-GPU sandbox escape via Skia.",null,"md",{},true,"\u002Fblog\u002Freading-memory-by-painting-it",{"title":5,"description":20540},"blog\u002Freading-memory-by-painting-it",false,"ZLLtsYZoyBGC_jGOWsDn3_HdKiw7-o7W0qJwH2O3sMo",1786604865289]